Loading vulnerability…
EchoLeak is a critical information disclosure vulnerability in Microsoft 365 Copilot caused by AI command injection through untrusted retrieved content. The flaw allows a remote, unauthenticated attacker to place hidden prompt-injection content in an email that is later ingested by Copilot’s retrieval-augmented workflow when the victim asks an otherwise normal question. Copilot can then treat attacker-controlled content as instructions, causing it to assemble and disclose sensitive enterprise data available through the victim’s Microsoft Graph-backed access, including content from Outlook, Teams, OneDrive, and SharePoint. Public reporting describes the issue as a zero-click indirect prompt injection attack in a production AI system, with the exploit chain reportedly bypassing multiple safeguards including prompt-injection classification, link redaction, and content security restrictions by abusing trusted rendering and fetch behaviors. Microsoft classified the issue as an M365 Copilot information disclosure vulnerability and described it as AI command injection that allows unauthorized disclosure over a network.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository is a real offensive security testing tool rather than a simple detector or README-only project. It is a Node.js CLI utility named valtik-markdown-exfil-tester that targets the markdown/HTML exfiltration class affecting LLM-backed chatbots, especially where prompt injection causes the model to emit renderable markdown or HTML that triggers browser-side fetches. The core capability is to prove whether a chatbot/frontend combination can be induced to fetch attacker-controlled URLs and leak marker data through query parameters. Repository structure is compact and modular. The main entry point is src/cli.js, which parses arguments, starts the local sink, loads payloads, optionally launches Playwright, delivers payloads, renders responses, classifies results, and prints reports. src/sink.js implements a localhost-only HTTP listener on 127.0.0.1 with a random or user-specified port; it records request metadata including path, query, headers, referer, IP, and user-agent. src/browser.js wraps Playwright Chromium to render arbitrary HTML/markdown and capture outbound and failed requests, enabling distinction between successful fetches and blocked attempts. src/classify.js correlates sink hits, browser requests, failed requests, and LLM response text to classify each payload as confirmed, browser-tried, llm-emitted, refused, or inconclusive. Delivery logic is split into two modes. src/deliver/direct.js performs direct POST submission to a chatbot endpoint using several common API request shapes: OpenAI-style chat completions, Anthropic-style messages, simple JSON message/prompt bodies, and form-encoded q=. It extracts response text heuristically from multiple common JSON response formats or SSE/plain text. src/deliver/indirect-doc.js supports indirect prompt injection by generating markdown documents containing payloads, writing them to disk for later upload into a target knowledge base, RAG source, support system, or similar ingestion path, then waiting for sink hits tagged with the payload ID. The payload library in src/payloads/library.json is the main exploit content. It contains a broad set of render-side exfil vectors: markdown images, reference-style links and images, raw HTML img tags, srcset, SVG image href/xlink, iframe, object, embed/media-related tags, form-related vectors, and prompt-wrapped social-engineering payloads that explicitly instruct the LLM to reproduce the malicious markup. Templates substitute a sink URL, sink host, payload ID, and a placeholder secret token (SECRET_PROBE). This makes the tool operational rather than a bare PoC, though payload customization is still relatively simple and local. Notable network/target behavior: the tool does not hardcode an external attacker server; instead it creates a local HTTP sink at 127.0.0.1:<port> and points payloads there for correlation. The actual remote target is user-supplied as <chatbot-url> and optionally --endpoint. In direct mode it sends POST requests to the target endpoint. In browser-assisted mode it renders returned content locally and observes whether the browser attempts to fetch the sink URL. The tool also records referer values, which can help demonstrate what page or thread triggered the exfil attempt. Overall, this repository is best characterized as an operational black-box exploit/testing harness for browser-mediated markdown/HTML exfiltration in LLM chatbot ecosystems. It is not malware and does not steal real secrets by default, but it is clearly exploit-oriented: it automates payload delivery, render-side triggering, network capture, and severity classification for a known vulnerability class associated with CVE-2025-32711 and similar issues.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cited high-severity vulnerability associated with indirect prompt injection in AI agents, where the agent trusted untrusted content.
Критическая zero-click prompt injection уязвимость в Microsoft 365 Copilot, позволявшая удалённому неаутентифицированному атакующему эксфильтровать конфиденциальные данные через RAG-контекст и автоматическую загрузку внешнего ресурса.
A flaw in Microsoft 365 Copilot that allowed a crafted email to induce the assistant to leak internal files without user interaction.
A critical vulnerability in Microsoft 365 Copilot where a hidden-text email could induce the assistant to disclose internal company data in response to later normal user queries.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.