Loading vulnerability…
SearchLeak
SearchLeak is an information disclosure vulnerability chain in Microsoft 365 Copilot Enterprise Search. It combines parameter-to-prompt injection through the search query parameter, an HTML rendering race condition during streamed responses, and server-side request forgery through Bing Search by Image. A crafted link causes Copilot to interpret attacker-controlled search text as instructions, retrieve sensitive information available to the signed-in user, and embed that information in an image request. The browser processes the image markup before output neutralization completes, while Bing's server-side image fetching provides an exfiltration channel that bypasses the browser's Content Security Policy. A single victim click can therefore disclose enterprise data to an unauthenticated remote attacker. Microsoft classifies the underlying weakness as command injection and has fully mitigated the issue in the cloud service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of information accessible to the victim through Copilot Enterprise Search, including mailbox contents, calendar events, meeting notes, and indexed SharePoint and OneDrive documents. Exposed email content can include one-time authentication codes and password-reset links, potentially facilitating subsequent account compromise. Pre-authenticated file download links may also be disclosed. The attack operates within the victim's existing access scope rather than granting additional permissions. No in-the-wild exploitation was reported before remediation; arbitrary code execution is not established by the detailed attack chain or Microsoft's product advisory.
If you can’t patch tonight, do this now.
No customer mitigation is required for this vulnerability because Microsoft has fully mitigated it. Supplemental defenses against similar attack chains include monitoring Copilot Search queries for encoded prompt-injection or HTML/image-embedding instructions, investigating unusual Bing image-search requests, restricting unnecessary Copilot indexing and retrieval access, and segmenting sensitive data sources. Platform-level preventive controls include sanitizing streamed output before rendering and reviewing CSP allowlists for services capable of fetching attacker-supplied destinations.
Patch, then assume compromise.
Microsoft has fully remediated the vulnerability server-side in the Microsoft 365 Copilot service. No customer patch installation, configuration change, or other remediation action is required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.