CVE-2026-103572: a trailing dot let Visual Studio Copilot rewrite protected config and run commands

Vulnerability · GitHub Copilot (Visual Studio / SSMS) · HIGH

Incident dateNot stated

DisclosedOct 13, 2026 (Microsoft Patch Tuesday, researcher write-up and NVD).

Added hereOct 14, 8:22 AM ET

Last verifiedOct 14, 2026

Summary

Johann Rehberger (Embrace The Red) showed that GitHub Copilot in Visual Studio and SQL Server Management Studio blocked writes to files such as .mcp.json and settings.VisualStudio.json by comparing path strings, but Windows drops a trailing period when saving a filename. Writing .mcp.json. therefore passed the check and landed on .mcp.json. That let a steered agent add a malicious MCP server or rewrite the ripgrep path and run commands. Microsoft fixed it in the October 13, 2026 Patch Tuesday release. Fixed builds are Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4. SSMS shares the same vulnerable Copilot code and needs the same update pass.

Severity

HIGH Code execution on a developer machine from untrusted content the agent reads, including via indirect prompt injection. Microsoft rates it Important, CVSS 3.1 8.8 High, and requires user interaction with Copilot. Fixed.

Timeline

Aug 4, 2026
Rehberger reports the path bypass and RCE to Microsoft, then shares Visual Studio exploits through Aug 7.
Sep 16, 2026
Microsoft confirms the vulnerability.
Oct 11, 2026
Microsoft awards a $0 bounty, which Rehberger notes in his write-up.
Oct 13, 2026
Fix ships in Patch Tuesday. Microsoft publishes CVE-2026-103572. Rehberger publishes the technical write-up the same day.

How it happened

The check lives in Microsoft.VisualStudio.Copilot.Core.dll (GetEditConfirmationTypeAsync). It compared the requested path to protected names as plain strings. On Windows, a filename that ends with a period is saved without that character, so .mcp.json. and settings.VisualStudio.json. matched neither blocked name, then wrote the protected file. Rehberger demonstrated two follow-ons: planting an MCP server the IDE launches, and pointing copilot.general.tools.ripgrepPath at an attacker binary that runs on search. Microsoft's FAQ says exploitation needs the user to interact with Copilot, and that prompt injection can deliver the steered instructions. The fix adds GetFullPath so the trailing dot is removed before the check. Microsoft's CVE title names Visual Studio Tools for Applications and SQL Server Management Studio; the researcher write-up and Microsoft's FAQ describe the issue in Copilot.

How to check your app

Update Visual Studio 2022 to 17.14.42 or later, or Visual Studio 2026 to 18.10.4 or later, and update SQL Server Management Studio in the same pass.
Review .mcp.json and settings.VisualStudio.json for MCP servers or ripgrepPath values you did not set.
Treat agent edits to MCP and IDE settings as something to review, even when the path looks slightly different from the protected name.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.