Vulnerability
A trailing dot in a file name lets Copilot in Visual Studio and SSMS bypass a check and execute commands.
Windows ignores the trailing dot, so writing .mcp.json. actually targets the protected file .mcp.json.
The researcher showed an exploitation by a third party via an indirect prompt injection.
The flaw CVE-2026-103572 is in Microsoft.VisualStudio.Copilot.Core.dll and also affects Visual Studio 2022.
Rated Important with a CVSS score of 8.8, the flaw was fixed on October 13, 2026 without a bounty paid.