A Dot Is All You Need: Visual Studio Copilot Gets an 8.8 RCE via Trailing-Dot Path Bypass

2026-10-14 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 13 October 2026, as part of Patch Tuesday, Microsoft shipped a fix for CVE-2026-103572 — “Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability”, CWE-94, scored 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, temporal 7.7). The NVD record went live at 19:17Z. The same day, researcher Johann Rehberger (wunderwuzzi, Embrace The Red) published the full write-up and proof-of-concept demonstrations he had reported to MSRC on 4 August. The core defect is one character long: a trailing dot.

The vulnerable check lives in EditsFunctionHandler.GetEditConfirmationTypeAsync, inside the shared Copilot library Microsoft.VisualStudio.Copilot.Core.dll. Its job is to stop Copilot from writing to its own settings and MCP configuration files — names like .mcp.json or settings.visualstudio.json — without user confirmation. It does this by comparing the requested filename against the protected names as strings. But on Windows, a filename ending in an ASCII period is legal at the API surface and silently normalised on write: settings.json. and settings.json are different strings that name the same file. Microsoft documents the behaviour plainly: “File and Folder names that end with the ASCII Period (0x2E) character will also be saved without this character.” So the validation passes — the strings differ — and the Win32 layer then strips the dot and overwrites the protected file. In the researcher’s words: “A trailing dot allowed the AI agent to bypass protections around sensitive configuration files and modify settings it was explicitly supposed to be prevented from changing.”

One dot, three companion findings

The trailing dot is the headline, but the write-up documents what the author found while building a working exploit, and the companions matter because they turn a local curiosity into a remote chain. First, path traversal from the trusted Extensions directory: paths beginning inside the trusted directory can contain ..\ components and resolve outside it, which permits reading SSMS.isolation.ini and reaching the user’s settings file without the expected confirmation. Second, installation-ID disclosure: that INI file discloses the InstallationID, which is needed to construct the per-install settings path (C:\Users\<user>\AppData\Local\Microsoft\SSMS\22.0_<InstallationID>\settings.json) where an attacker can auto-enable MCP servers. Third, a model observation rather than a code defect: Microsoft’s MAI-Code-1-Flash, the model behind this Copilot surface, showed “quite poor indirect prompt injection resilience” in the researcher’s testing.

The two attack chains

With the gate defeated, a misaligned or hijacked agent can write a malicious .mcp.json (adding a hostile command as an MCP server, enabling it in enabledMcpServers, removing it from disabledMcpServers) and let the IDE launch it — the path demonstrated against SSMS in a narrated video. In Visual Studio there is a shorter road: the ripgrepPath setting in settings.VisualStudio.json accepts an arbitrary binary path that Copilot launches whenever it performs a search. The published proof of concept has the injected content instruct Copilot to create settings.visualstudio.json. — dot included — containing "copilot.general.tools.ripgrepPath": "C:\\Windows\\System32\\calc.exe" (plus a theme change, a nice touch proving the attacker controls the whole file), then run a grep for “hello”. Calculator opens. The content that hijacks the agent, the write-up notes, could equally arrive “via other means, like data returned from an MCP server” — which is what makes this remote rather than merely local.

Microsoft agrees with that framing, unusually explicitly. The MSRC advisory’s FAQ asks how an attacker could exploit the flaw and answers that “an attacker can deliver a malicious prompt remotely without prior access”, adding: “Due to prompt injection, the system is coerced into executing attacker-controlled instructions, which can escalate into remote code execution (RCE) when the compromised prompt causes backend components or integrated tools to run unintended commands.” A first-party advisory naming prompt injection as the delivery mechanism, with AV:N on the vector, is worth filing away: the vendor’s own scoring concedes the network-reachable prompt as the attack vector, while the record’s publiclyDisclosed: No / exploited: No flags and “Exploitation Less Likely” assessment describe detection status, not exploitability.

The fix, and the bounty line

The researcher examined the patch the day it shipped and reports the fix is a call to GetFullPath added before the check, which normalises the filename — stripping the trailing dot and resolving relative components such as ... One canonicalisation call therefore addresses the headline bypass and should also close several of the traversal variants. The lesson is the oldest one in path validation — compare the canonical form, not the input string — arriving, once again, inside an AI product where the parser of the request (string comparison) and the executor (the Win32 layer) are two different programs. Readers of yesterday’s briefing will recognise the shape: Roo Code’s approval gate disagreed with bash in five ways; here a confirmation gate disagrees with NTFS in one.

The disclosure timeline, as published: reported 4 August, Visual Studio implications shared 4–7 August, follow-up 30 August, Microsoft confirmation 16 September, patch 13 October. And then the line that will travel further than the technical detail: on 11 October Microsoft awarded a $0 bounty, ruling the confirmed, patched, 8.8 RCE out of scope for a reward. The researcher says this is his third Copilot vulnerability in two months to end this way, and worries “researchers might stop reporting vulnerabilities directly to Microsoft first, if that is a common experience.” Set that beside last week’s Copilot CLI finding, which GitHub validated and then declined to call a vulnerability at all: two Copilot surfaces, two researchers, two polite declines — one “not a vulnerability”, one “not a rewarded vulnerability” — and in both cases the behaviour shipped to millions of developers. The economics of reporting Copilot flaws are becoming part of the vulnerability story itself.

What to do

Install the October Patch Tuesday updates for Visual Studio (including 2022) and SSMS; both share the vulnerable DLL, so patching one surface and not the other leaves the flaw in place. Secondary coverage lists the fixed builds as 17.14.42 and 18.10.4 — confirm against the advisory for your channel. Beyond patching, treat the two primitives as audit prompts for your own agent tooling: any guard that compares a requested path against a protected list must canonicalise first (GetFullPath or equivalent) on Windows, and any MCP-server allowlist that an agent can edit is not an allowlist but a launch menu. If your developers use Copilot inside database tooling, note the SSMS angle specifically — the DBA workstation is now in scope for prompt-injection-delivered RCE, not just the developer laptop.

What we verified, and what we did not

CVE identifier, NVD publication timestamp, CVSS 3.1 base vector and score, CWE-94 assignment, description text and reference list were read first-hand from the NVD 2.0 API. Severity (Important), impact (RCE), temporal score (7.7), assessment flags and the prompt-injection FAQ text were read first-hand from the MSRC API record. The mechanism, timeline, bounty outcome, fix analysis, affected DLL and function name, and all quoted passages are from Johann Rehberger’s primary write-up, fetched in full; the Windows trailing-period behaviour was cross-checked against Microsoft’s “Naming Files, Paths, and Namespaces” documentation. Fixed build numbers are carried as reported by secondary coverage, not confirmed against Microsoft’s advisory text.

We did not install Visual Studio or SSMS, did not reproduce the trailing-dot write, did not run any proof of concept, and sent no malicious prompt to any Copilot deployment. The exploit demonstrations are the researcher’s, reported as his.

Sources: