Index

Search

Search the public record. Drafts and scheduled notes are not included.

research

Visual Studio and SSMS Copilot flaw CVE-2026-103572 allows code execution

Microsoft fixed CVE-2026-103572 on 13 October 2026. A prompt-injected GitHub Copilot in Visual Studio or SSMS could rewrite its own config and run code. CVSS 3.1 8.8 (Important, scored by Microsoft). Fixed in Visual Studio 2022 17.14.42 and 2026 18.10.4. Researcher PoC public. Not exploited, not in CISA KEV.

Published 3h ago

HighPoC Available

CVE-2026-103572

Visual Studio and SSMS GitHub Copilot code injection RCE

RCE

Published 22h ago