A trailing period in a filename was enough to defeat a protection intended to stop Copilot from rewriting its own configuration. According to security researcher Johann Rehberger, that file-validation failure could turn an indirect prompt injection into arbitrary command execution in Visual Studio and SQL Server Management Studio.
Microsoft shipped a fix on October 13, 2026, following Rehberger’s August report. In his technical disclosure, Rehberger says Microsoft classified CVE-2026-103572 as an Important remote code execution vulnerability with a CVSS score of 8.8.
Affected Visual Studio and SQL Server Management Studio installations should be updated. The attack crossed a security boundary because the software enforcing Copilot’s file-access restrictions misunderstood which file Windows would actually write. A hijacked agent could then change configuration that caused its host application to launch an attacker-selected command.
Windows Resolved a Different Filename Than Copilot Checked
Copilot had checks intended to prevent it from modifying sensitive settings and configuration files. Those checks examined the supplied filename, but ordinary Windows file operations could interpret that name differently.
For example, settings.json and settings.json. are different strings. Under normal Win32 path processing, however, a trailing period can be removed, causing both names to address the same file. The underlying filesystem and the Windows APIs above it do not always treat filenames identically.
Rehberger found that a trailing-dot variation could pass Copilot’s protected-filename check. When the subsequent write reached the Windows file APIs, normalization removed the distinction that had allowed it through. The agent could therefore overwrite a file that the application was supposed to protect.
The failure came down to the order of operations: the application made its security decision using one representation of a path, then performed the operation using another. A restriction on the first representation did not reliably protect the actual destination.
Rehberger also reported related path-traversal problems. A path could appear to begin in a trusted extensions directory while relative directory components caused it to resolve somewhere else. In those cases, too, the path’s textual appearance did not reliably identify its destination.
For developers, the rule is to resolve and normalize a path before using it to make an access-control decision. Validation must apply to the destination the file operation will actually reach.
