Trailing-dot bypass yields RCE in Visual Studio Copilot and SSMS (CVE-2026-103572)
A trailing dot in settings.json. bypassed the Copilot filename guard in Visual Studio and SSMS, turning prompt injection into RCE; Microsoft fixed it on Oct 13.
Microsoft’s October 13 Patch Tuesday shipped a fix for a remote code execution vulnerability in the Copilot coding agent built into Visual Studio and SQL Server Management Studio, tracked as CVE-2026-103572. Copilot asks for confirmation before writing to protected config files such as .mcp.json and settings.VisualStudio.json — and Johann Rehberger, the security researcher behind the Embrace The Red blog, published the full bypass the same day: the guard compares filenames as plain strings, while Windows drops a trailing dot when a file hits disk. Writing “settings.json.” therefore edits the real file, which lets an injected prompt register a malicious MCP server and run arbitrary commands. Per the researcher, Microsoft rated it an Important-severity RCE with a CVSS score of 8.8.
Key points
- The flawed check sits in
Microsoft.VisualStudio.Copilot.Core.dll(GetEditConfirmationTypeAsync): a string comparison with no path normalization. - A trailing dot —
settings.json.,.mcp.json.— passes the guard, and Windows lands it on disk as the protected file itself. Through indirect prompt injection an attacker can write.mcp.json; the IDE then launches the registered MCP server, so its command runs as the user. - Microsoft fixed it in Visual Studio 2026 18.10.4 on October 13, per the release notes. SSMS is affected too — the official CVE title reads “SSMS SQLtoolsMCPserver.exe RCE”.
Background
Copilot’s agent mode in VS and SSMS edits files and runs tools on the user’s behalf, so Microsoft gates writes to config files — the check published with the disclosure covers mcp.json, .mcp.json, and names ending in settings.visualstudio.json. The .mcp.json entry carries extra weight because it is an execution primitive: the IDE launches whatever MCP servers it registers, every time it starts. Rehberger reported the issue on August 4, Microsoft confirmed on September 16, and the patch landed October 13 — two months and a week end to end. It is a concrete, OS-level footnote to what Satya Nadella said just days ago about assuming AI models are already breached.
How the chain works
The attack against Copilot’s file guard runs in three steps. First, untrusted content — a web page, a repository file, an issue comment — reaches the model, and indirect prompt injection drives the agent to write .mcp.json.: the guard sees a name outside its protected list and approves the write; Windows drops the trailing dot on disk, producing the protected .mcp.json. Second, the same trick edits the MCP configuration itself: the attacker’s server goes into enabledMcpServers and comes out of disabledMcpServers, and the IDE launches it — the registered command now executes with the user’s privileges.
Third, the attacker has to find the file. SSMS’s real settings path embeds a per-instance ID; Rehberger used a .. traversal through the trusted Extensions directory, which no check inspected, to read InstallationID from SSMS.isolation.ini and assemble the full path. On the VS side there is a second route: overwrite copilot.general.tools.ripgrepPath in settings.VisualStudio.json, and every agent search executes whatever binary that setting points to. His proof of concept ran against Microsoft’s own MAI-Code-1-Flash model and popped calc.exe.
| Date | Milestone |
|---|---|
| 2026-08-04 | Rehberger reports to Microsoft, later shares working exploits |
| 2026-09-16 | Microsoft confirms the issue |
| 2026-10-11 | Bounty decision: $0 |
| 2026-10-13 | Patch Tuesday ships the fix; details published |
The fix and the record
Version 18.10.4 adds GetFullPath to the check: normalize the path, strip the trailing dot, resolve .., then compare. Canonicalize before comparing — the textbook form of a path check, applied one release too late.
Two attribution details matter when reading the official record. The MSRC entry’s title names only SSMS’s SQLtoolsMCPserver.exe; the claim that VS Copilot is affected rests on Rehberger’s analysis. And the release-notes table carries no severity column — the 8.8 score and the Important rating come from the researcher quoting Microsoft’s classification. And CVE-2026-21256 — another Copilot flaw, a command injection disclosed in February 2026 carrying the same 8.8 score — is a separate issue, easy to conflate when searching.
What others say
Public reaction concentrated on disclosure day. daily.dev covered it on October 13, summarizing the bug as an RCE in Copilot as integrated into VS and SSMS, CVSS 8.8. On X, Rehberger confirmed the fix shipped with Patch Tuesday and gave the root cause in one line: a trailing dot added to a config filename defeated Copilot’s security controls. His write-up closes with “Assume Breach. Trust No AI.” — defenses should hold even when the agent itself is compromised or misled. He also raised the money question: this is his third vulnerability in two months that Microsoft patched without paying a bounty, and the October 11 decision on this one was $0.
Our take
The line of code behind CVE-2026-103572 fails a lesson as old as path handling: string comparison cannot survive the OS’s filename semantics, and canonicalization has to happen before the comparison. In an agent, the same defect scales — Manus’s Gmail integration already showed what untrusted content reaching an execution layer looks like, and .mcp.json upgrades “reaching” into “executing on every startup”. If you run Copilot inside VS or SSMS, update to 18.10.4 or newer now; mixed fleets should also pin down the matching fixes for SSMS and VS 2022, whose version numbers the sources I read never state — check MSRC item by item. And start treating .mcp.json as a deployment artifact: locked, reviewed, watched for changes. As Microsoft keeps pulling more surfaces into Copilot, the payoff from hijacking its config only grows — a $0 bounty against an 8.8 rating is a gap every bug-bounty program should be asked to explain.