PT-2026-46401 · Microsoft · M365 Copilot+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft 365 Copilot Enterprise (affected versions not specified)
Description
A critical vulnerability chain known as SearchLeak allows an unauthorized attacker to exfiltrate sensitive corporate data, including email contents, MFA codes, calendar details, and confidential files from OneDrive or SharePoint. The attack requires only a single click on a link pointing to a legitimate microsoft.com domain and inherits the victim's full graph permissions within the organization.
The issue consists of a three-stage chain:
- Parameter-to-Prompt (P2P) Injection: The
qURL parameter in Microsoft 365 Copilot Search is interpreted as executable instructions rather than a search string, allowing attackers to command Copilot to search the victim's data. - HTML Rendering Race Condition: During the AI streaming phase, raw HTML such as
<img>tags is temporarily rendered in the DOM before a sanitizer can wrap the output in<code>blocks, allowing the browser to fire HTTP requests. - Server-Side Request Forgery (SSRF): The attacker uses the
searchbyimageendpoint of Bing (which is CSP-allowlisted) to perform a server-side fetch of a URL containing the stolen data, bypassing the Content Security Policy (CSP) to relay information to the attacker's server.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Monitor Copilot Search URLs for encoded payloads in the
q parameter containing HTML or image-embedding instructions.Audit CSP allowlists for any domain that performs server-side fetches on user-supplied URLs.
Alert users to inspect Microsoft 365 links with long, encoded query strings before clicking.
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
M365 Copilot
Copilot