Visual Studio Copilot and SSMS: a trailing dot let a prompt-injected agent rewrite .mcp.json and run code (CVE-2026-103572, 8.8); fixed 2026-10-13

View raw markdownEdit on GitHub ↗

TL;DR

Microsoft's CVE-2026-103572 (published 2026-10-13, CVSS 8.8, CWE-94) covers Visual Studio 2022 17.14.0 before 17.14.42 and Visual Studio 2026 18.10.0 before 18.10.4; the record's title also names Visual Studio Tools for Applications and SQL Server Management Studio, for which it lists no version. Johann Rehberger (Embrace The Red) published the mechanism on 2026-10-14: Windows drops a trailing period from a filename, so Copilot's check that blocks writes to its own MCP and settings files passed .mcp.json. and wrote .mcp.json. A Copilot agent steered by prompt injection, for example through data an MCP server returns, could therefore register a new MCP server or change tool paths and run commands as the user. Microsoft's own FAQ says the same in its words: "due to prompt injection, the system is coerced into executing attacker-controlled instructions", escalating to code execution. Reported 2026-08-04, confirmed 2026-09-16, fixed in the October Patch Tuesday by normalising paths before validation. Update Visual Studio (no SSMS build is on record), then read your .mcp.json and settings files for servers you did not add.

What happened

The record

CVE Services carries the record with CNA Microsoft, published 2026-10-13: "Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network." Two affected products are listed, both Visual Studio: 2022 version 17.14 from 17.14.0 before 17.14.42, and 2026 version 18.10 from 18.10.0 before 18.10.4. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, severity Important, impact Remote Code Execution, exploited No, publicly disclosed No, customer action required.

The MSRC FAQ is where the mechanism class is stated: AV:N "means an attacker can deliver a malicious prompt remotely without prior access", UI:R "means a user must interact with Copilot for exploitation to occur", and the prompt injection "can escalate into remote code execution (RCE) when the compromised prompt causes backend components or integrated tools to run unintended commands."

One gap in the record, stated here rather than filled in: the title names Visual Studio Tools for Applications and SQL Server Management Studio, and the affected list carries neither, so no fixed SSMS or VSTA build number can be derived from it. The record is part of the October 2026 release, not of September's.

The researcher's account

Rehberger found the bug while validating Microsoft's fixes for his earlier SQL Copilot reports. The shared component is Microsoft.VisualStudio.Copilot.Core.dll, which Visual Studio and SSMS both ship, so one bug reached both products and, per the post, older Visual Studio lines including 2022. Copilot's file tools validate the target path against a list of protected names (its MCP configuration and settings files) so that the agent cannot change its own configuration without a human. Windows ignores a trailing period in a filename, so a write to a protected name with a period appended passed the check and landed on the protected file. The post also reports path-traversal variants of the same check and weak prompt-injection resilience in the MAI-Code-1-Flash model, both as the researcher's observations.

The consequence is the one this corpus keeps recording for coding agents: an edit to .mcp.json registers a server, and a server's command line runs on the next session. The injected text can arrive through anything the agent reads, including the output of an MCP tool already configured.

Timeline from the post: 2026-08-04 initial report of the path bypass to code execution; 08-04 to 08-07 the Visual Studio implications shared; 08-30 follow-up; 09-16 Microsoft confirmed; 10-11 bounty decision, $0, out of scope; 10-13 fix released. The fix adds a GetFullPath call, which strips trailing dots and resolves .. components before the protected-name comparison, so the traversal variants should close with it; the post says so and the record does not, so that part is the researcher's statement.

Why it matters beyond Visual Studio

The protected-file list is a sandbox boundary expressed as string comparison, and the operating system's path rules are the more capable parser. This is the Windows sibling of the Claude Code write-time symlink TOCTOU and of the Cursor sandbox escapes through path canonicalisation, and it landed in the same release as a VS Code record for the same outcome through a lifecycle-hook file (CVE-2026-102232). Every agent that protects its own configuration by filename has this class until it canonicalises first.

Am I affected?

# Visual Studio version (Help > About, or vswhere)
& "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -all -property catalog_productDisplayVersion
# 17.14.x below 17.14.42, or 18.10.x below 18.10.4, is affected.

# SSMS: Help > About. The record lists no SSMS version; see the note below.

# MCP configuration files, their last write time, and their contents. The trailing period never
# reaches disk (Windows strips it; that is the bug), so the artefact is the modified .mcp.json itself.
Get-ChildItem -Recurse -Force -Filter ".mcp.json" -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName; $_.LastWriteTime; Get-Content $_.FullName }

Read each .mcp.json and the Copilot settings files for a server entry, a disabled-server list change or a tool path you did not write. A server whose command you do not recognise, added while an agent session was running against content you did not control, is the artefact.

SSMS: Microsoft's title names it and the researcher names the shared component, but the record carries no SSMS version and no SSMS fixed build, so this file cannot say which SSMS release closes it. Microsoft's SSMS release notes list 22.11.0 with a release date of 2026-10-13, the same day as the fix, and that release's notes (Copilot Agent Mode generally available, bundled SQL Tools MCP server 3.0.17) do not name this CVE or any security fix. Whether 22.11.0 carries the fix is unstated; treat the SSMS boundary as unknown until Microsoft lists a version.

If you are affected

Update Visual Studio to 17.14.42 or 18.10.4 or later; for SSMS, no fixed build is on record (see the note above). Remove any MCP server entry you did not add, then treat whatever that server's command could reach as exposed: if an MCP server was malicious, then if your local AI agent was exploited.

Prevention

  • Treat an agent's write access to its own configuration files as a security boundary and keep it behind a human approval that cannot be satisfied by a filename trick; mcp-hygiene.
  • Read MCP tool output as untrusted input to the agent, because it is where the injected text arrives in this report.
  • Keep IDE Copilot features on the current Patch Tuesday build; the fix is in the shared component, not in a setting.
  • agent-sandboxing for the container-first setup that bounds what a rewritten .mcp.json can run.

Sources