SearchLeak M365 Copilot Streaming HTML Injection via Bing img Tag

Ibrahim Saud@tektrix

•updated Jul 1, 2026•10•0•22

Detects a potential exploitation of the SearchLeak (CVE-2026-42824) vulnerability in Microsoft 365 Copilot, where raw HTML <img> tags containing Bing Search-by-Image parameters are rendered during the streaming phase before proper sanitization occurs. This could potentially allow for SSRF or information leakage through malicious image references.