--- title: Visual Studio Copilot and SSMS Remote Code Execution... description: Microsoft patched a Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) in GitHub Copilot as integrated into Visual Studio and SQL Server... canonical: https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) · Embrace The Red | daily.dev og:description: Microsoft patched a Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) in GitHub Copilot as integrated into Visual Studio and SQL Server... og:url: https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w og:image: https://api.daily.dev/og/posts/StLvDWT6w.png og:image:alt: Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) · Embrace The Red og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 7 min read · 0 upvotes · 0 comments ## Summary Microsoft patched a Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) in GitHub Copilot as integrated into Visual Studio and SQL Server Management Studio, disclosed by a researcher who reported it in August. The root cause is a path validation bypass exploiting Windows' handling of trailing dots in filenames (e.g. "settings.json." resolves to "settings.json"), which let Copilot write to protected configuration and MCP server files it should be blocked from modifying. Combined with path traversal and installation-ID disclosure via SSMS.isolation.ini, an attacker could use indirect prompt injection to hijack Copilot's AI model (MAI-Code-1-Flash) and achieve arbitrary command execution, demonstrated by popping calc.exe. The fix, shipped October 13, 2026 as part of Patch Tuesday, adds a GetFullPath call to normalize filenames and strip trailing dots. The researcher notes Microsoft awarded a $0 bounty despite confirming the vulnerability, the third such unrewarded report in two months. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-103572 and how does it allow remote code execution in Visual Studio Copilot? CVE-2026-103572 is an Important-severity RCE vulnerability (CVSS 8.8) in Microsoft.VisualStudio.Copilot.Core.dll affecting Visual Studio and SQL Server Management Studio. It stems from a path validation bypass: Windows silently strips a trailing dot from filenames, so writing to "settings.json." actually targets "settings.json", letting Copilot bypass checks meant to block writes to protected config and MCP server files, enabling arbitrary command execution. Microsoft patched it on October 13, 2026 Patch Tuesday. _Developers patching Copilot-enabled IDEs can track emerging AI agent CVEs like this one on daily.dev._ ### How can a trailing dot bypass file path validation checks on Windows? Windows Win32 APIs silently remove a trailing ASCII period (0x2E) from file and folder names before writing, even though the name technically differs at the string level. This means a validation check comparing "settings.json" against "settings.json." sees them as different strings and passes, but the actual write still lands on "settings.json" once the OS strips the dot, bypassing any string-based protected-filename check. _Security engineers reviewing file validation logic can follow Windows canonicalization quirks like this on daily.dev._ ### How was Visual Studio Copilot hijacked to launch calc.exe via a prompt injection demo? The proof of concept instructed Copilot, via injected content, to create a file named settings.visualstudio.json. (with a trailing dot) setting the ripgrepPath configuration to C:\Windows\System32\calc.exe. Because of the trailing-dot bypass, the write actually targeted the real settings file, so the next time Copilot performed a search using ripgrep, it launched calc.exe instead, demonstrating arbitrary command execution via a misaligned AI agent. _Teams assessing AI coding agent risk can follow real-world exploit demos like this on daily.dev._ ## Similar posts on daily.dev - [From SELECT to SYSADMIN with SQL Copilot \(CVE-2026-65669\) · Embrace The Red](https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo) · Embrace The Red · 1 upvotes · 0 comments - [New attack turned Microsoft 365 Copilot into 1-click data theft tool](https://daily.dev/posts/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool-ffqgdzkcx) · BleepingComputer · 0 upvotes · 0 comments - [Critical Copilot vulnerability allowed hackers to seal 2FA code from users](https://daily.dev/posts/critical-copilot-vulnerability-allowed-hackers-to-seal-2fa-code-from-users-ffggsogtl) · Ars Technica · 1 upvotes · 1 comments - [Copilot 'SearchLeak' Attack Allows 1-Click Data Theft](https://daily.dev/posts/copilot-searchleak-attack-allows-1-click-data-theft-wrsuwvrwg) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#visual-studio](https://daily.dev/tags/visual-studio), [#microsoft-sql-server](https://daily.dev/tags/microsoft-sql-server), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) · Embrace The Red","url":"https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w"},"datePublished":"2026-10-13T23:54:17.564Z","dateModified":"2026-10-14T00:17:41.167Z","description":"Microsoft patched a Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) in GitHub Copilot as integrated into Visual Studio and SQL Server...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e21cd68a180d2ffa70039b479ea32390?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e21cd68a180d2ffa70039b479ea32390?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Embrace The Red","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embrace The Red","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/50e27c500f1444fd9ed7d91301ed2e9c","url":"https://daily.dev/sources/embracethered"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,visual-studio,microsoft-sql-server,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embrace The Red","item":"https://daily.dev/sources/embracethered"},{"@type":"ListItem","position":3,"name":"Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) · Embrace The Red"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/visual-studio-copilot-and-ssms-remote-code-execution-cve-2026-103572-embrace-the-red-stlvdwt6w#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-103572 and how does it allow remote code execution in Visual Studio Copilot?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-103572 is an Important-severity RCE vulnerability (CVSS 8.8) in Microsoft.VisualStudio.Copilot.Core.dll affecting Visual Studio and SQL Server Management Studio. It stems from a path validation bypass: Windows silently strips a trailing dot from filenames, so writing to \"settings.json.\" actually targets \"settings.json\", letting Copilot bypass checks meant to block writes to protected config and MCP server files, enabling arbitrary command execution. Microsoft patched it on October 13, 2026 Patch Tuesday. Developers patching Copilot-enabled IDEs can track emerging AI agent CVEs like this one on daily.dev."}},{"@type":"Question","name":"How can a trailing dot bypass file path validation checks on Windows?","acceptedAnswer":{"@type":"Answer","text":"Windows Win32 APIs silently remove a trailing ASCII period (0x2E) from file and folder names before writing, even though the name technically differs at the string level. This means a validation check comparing \"settings.json\" against \"settings.json.\" sees them as different strings and passes, but the actual write still lands on \"settings.json\" once the OS strips the dot, bypassing any string-based protected-filename check. Security engineers reviewing file validation logic can follow Windows canonicalization quirks like this on daily.dev."}},{"@type":"Question","name":"How was Visual Studio Copilot hijacked to launch calc.exe via a prompt injection demo?","acceptedAnswer":{"@type":"Answer","text":"The proof of concept instructed Copilot, via injected content, to create a file named settings.visualstudio.json. (with a trailing dot) setting the ripgrepPath configuration to C:\\Windows\\System32\\calc.exe. Because of the trailing-dot bypass, the write actually targeted the real settings file, so the next time Copilot performed a search using ripgrep, it launched calc.exe instead, demonstrating arbitrary command execution via a misaligned AI agent. Teams assessing AI coding agent risk can follow real-world exploit demos like this on daily.dev."}}]} ```