SearchLeak CVE-2026-42824 Copilot Prompt Injection via Encoded Search Query

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects potential SearchLeak (CVE-2026-42824) prompt-to-parameter injection in Microsoft 365 Copilot Enterprise. The rule monitors for search operations containing URL-encoded characters, HTML/JS injection payloads, or anomalous long query strings that indicate a malicious attempt to influence search results or exfiltrate data.