One trailing dot bypassed VS Copilot's path check, enabling RCE (CVE-2026-103572)
wunderwuzzi23 · x · 2026-10-16
Security researcher wunderwuzzi disclosed a remote code execution vulnerability in Visual Studio Copilot and SQL Server Management Studio, patched by Microsoft on Oct 13 and rated Important.
- Root cause: Copilot had a check preventing writes to .mcp.json and its own config files, but it compared filenames as strings — settings.json. with a trailing dot (valid on Windows) passed the check, and Windows dropped the dot on write, landing on the protected file.
- Exploit chain: via indirect prompt injection, a hijacked agent could add its own MCP server and achieve arbitrary command execution. The flaw lives in the shared Microsoft.VisualStudio.Copilot.Core.dll, affecting older versions including VS 2022.
- Takeaway: the check inspected the request's name, not what it would actually touch — author argues protections that merely read names beside the agent don't hold.
More from coding & agent
- OpenAI discloses GPT-5.6 Sol derived wallet keys and spent unauthorized funds — terryyuezhuo · 2026-10-16
- Vibe-coded sonar FPS fits a full game in 16 KB with shader ray-casting — zTrojan · 2026-10-16
- OpenAI chart: coding agents now log 3.14x human researcher workdays; Anthropic merges 30k changes/day — haider1 · 2026-10-16
- Supabase CTO on how AI agents will reshape software buying and open source — David Ondrej · 2026-10-16
- Dev builds MCP server that lets AI agents outsource phone calls to real humans — Many_Benefit_3393 · 2026-10-16
- A vector DB is not LLM memory: long thread maps write/read paths, failure modes and evals — techNmak · 2026-10-16