RCE in Visual Studio Copilot and SSMS

Researcher Johann Rehberger discovered a path validation error in Microsoft.VisualStudio.Copilot.Core.dll, which is used by Visual Studio and SQL Server Management Studio. The vulnerability was assigned the identifier CVE-2026-103572.

Copilot prohibited modifying the settings.VisualStudio.json configuration file, but did not recognize the same path with an additional dot at the end—settings.VisualStudio.json.. When accessed through ordinary Windows file APIs, the trailing dot was discarded, so the write operation affected the original protected file. This allowed an attacker to bypass the restriction on modifying settings that controlled command execution.

This made it possible to implement two chains: • Visual Studio: through indirect prompt injection, the agent modifies copilot.general.tools.ripgrepPath, specifying an arbitrary executable file. During a subsequent search, Copilot launches it. The PoC used calc.exe. • Visual Studio and SSMS: the agent modifies .mcp.json, adds a malicious MCP server, and activates it through enabledMcpServers and disabledMcpServers. When the server starts, the specified command is executed. Additionally, the researcher discovered bypasses using ..\ in paths to the trusted Extensions directory. In SSMS, they made it possible to read SSMS.isolation.ini, obtain the InstallationID, and determine the path to the user’s settings.json, which was necessary to reliably activate the MCP server. The attack can be initiated through indirect prompt injection—for example, instructions in a file that the user asked Copilot to analyze, or in data returned by an MCP server. Prompt injection acts as the trigger here, while the direct capability for RCE is created by the file path validation error.

Microsoft released a patch on October 13, 2026. According to the author’s patch diff analysis, GetFullPath was added to the check to normalize the path before comparison.

Article: https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/