Visual Studio Copilot / SSMS Path-Validation Bypass to RCE via Indirect Prompt Injection

#!/usr/bin/env pwsh
# Check-CVE2026103572.ps1
# Checks whether Visual Studio or SSMS installations are vulnerable to CVE-2026-103572
# (Copilot path-validation bypass via trailing-dot filenames)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$vulnerable = $false
$found = $false

# Check Visual Studio 2022 (17.x) installations via vswhere
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
if (Test-Path $vswhere) {
    $instances = & $vswhere -all -format json 2>$null | ConvertFrom-Json
    foreach ($inst in $instances) {
        $ver = [version]$inst.installationVersion
        $name = $inst.displayName
        $found = $true
        # VS 2022 17.14.x: vulnerable if < 17.14.42
        if ($ver.Major -eq 17 -and $ver.Minor -eq 14) {
            if ($ver.Build -lt 42) {
                Write-Host "[!] $name ($ver) - VULNERABLE" -ForegroundColor Red
                $vulnerable = $true
            } else {
                Write-Host "[+] $name ($ver) - PATCHED" -ForegroundColor Green
            }
        }
        # VS 2026 18.10.x: vulnerable if < 18.10.4
        elseif ($ver.Major -eq 18 -and $ver.Minor -eq 10) {
            if ($ver.Build -lt 4) {
                Write-Host "[!] $name ($ver) - VULNERABLE" -ForegroundColor Red
                $vulnerable = $true
            } else {
                Write-Host "[+] $name ($ver) - PATCHED" -ForegroundColor Green
            }
        }
        else {
            Write-Host "[?] $name ($ver) - version outside known affected range, verify manually" -ForegroundColor Yellow
        }
        # Also check the DLL directly if accessible
        $dllPath = Join-Path $inst.installationPath "Common7\IDE\Extensions\Microsoft\Copilot\Microsoft.VisualStudio.Copilot.Core.dll"
        if (Test-Path $dllPath) {
            $dllVer = (Get-Item $dllPath).VersionInfo.FileVersion
            Write-Host "    Copilot DLL version: $dllVer"
        } else {
            Write-Host "    Copilot DLL not found (Copilot may not be installed - not vulnerable if absent)"
        }
    }
} else {
    Write-Host "[i] vswhere.exe not found - Visual Studio Installer not present" -ForegroundColor Cyan
}

# Check SSMS installations via registry
$ssmsKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server Management Studio',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server Management Studio'
)
foreach ($key in $ssmsKeys) {
    if (Test-Path $key) {
        Get-ChildItem $key -ErrorAction SilentlyContinue | ForEach-Object {
            $found = $true
            $ssmsVer = $_.PSChildName
            Write-Host "[i] SSMS installation detected: version key $ssmsVer" -ForegroundColor Cyan
            Write-Host "    Check for updated Copilot DLL in SSMS install directory manually."
            Write-Host "    If SSMS has Copilot/MCP integration enabled, treat as potentially VULNERABLE until patched."
        }
    }
}

if (-not $found) {
    Write-Host "UNKNOWN - No Visual Studio or SSMS installations detected" -ForegroundColor Yellow
    exit 2
}

if ($vulnerable) {
    Write-Host "`nVULNERABLE - One or more installations need patching for CVE-2026-103572" -ForegroundColor Red
    exit 1
} else {
    Write-Host "`nPATCHED - All detected installations appear to be at fixed versions" -ForegroundColor Green
    exit 0
}