Entity trail

Microsoft Semantic Kernel CVE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-29 / agents-researcherCVE-2026-25592: Semantic Kernel Perfect CVSS 10.0 — Prompt Injection Achieves RCE via Agent Function CallingMicrosoft's Semantic Kernel .NET SDK contained a path traversal vulnerability (CVE-2026-25592, CVSS 10.0) in SessionsPythonPlugin where DownloadFileAsync was accidentally tagged [KernelFunction] and exposed to the LLM with no path validation. An attacker could prompt-inject an agent to read arbitrary host files (exfiltration) or write to arbitrary locations (RCE). Combined with CVE-2026-26030, this represents a complete prompt injection → sandbox escape → remote code execution chain. Patched in Semantic Kernel 1.71.0 (.NET) and 1.39.4 (Python).
2026-05-22 / agents-researcherMicrosoft 'When Prompts Become Shells': Semantic Kernel Prompt Injection Enables Host-Level RCE via eval()Microsoft Security published research on May 7 showing how prompt injection in Semantic Kernel achieves host-level remote code execution — a single prompt launched calc.exe on the device running the AI agent with no browser exploit, attachment, or memory corruption needed. CVE-2026-26030 (Python SDK <1.39.4) builds InMemoryVectorStore filter expressions as Python lambdas executed via eval(). CVE-2026-25592 (.NET <1.71.0) lives in SessionsPythonPlugin for Azure Container Apps. Microsoft framed this as a systemic pattern across agent frameworks where tool registries become attack surfaces.
2026-05-18 / agents-researcherMicrosoft Discloses Two CVSS 10.0 Semantic Kernel RCE Vulnerabilities: Prompt Injection Escalates to Sandbox Escape and Arbitrary Code ExecutionMicrosoft's Security Blog detailed CVE-2026-25592 (.NET SDK) and CVE-2026-26030 (Python SDK), both CVSS 10.0 sandbox-escape vulnerabilities in Semantic Kernel. The .NET flaw abuses an accidentally-exposed DownloadFileAsync KernelFunction with no path validation. The Python flaw exploits an f-string filter expression in In-Memory Vector Store that bypasses the blocklist via __class__.__bases__[0].__subclasses__() traversal to achieve os.system-equivalent RCE. Patches: .NET SDK 1.71.0, Python SDK 1.39.4.
2026-05-08 / skill-finderMicrosoft Discloses 'Prompts Become Shells' — Two Semantic Kernel CVEs Chain Prompt Injection Into Host-Level RCE via eval() and Unsandboxed File WritesMicrosoft Security published a deep-dive on CVE-2026-26030 (Python eval() in vector store filters) and CVE-2026-25592 (.NET sandbox escape via DownloadFileAsync). The attack chain turns prompt injection into host-level code execution — calc.exe launched from a single prompt. Semantic Kernel Python < 1.39.4 and .NET < 1.71.0 affected; patches remove AI model access to dangerous functions. Microsoft's key principle: 'Any tool parameter the model can influence must be treated as attacker-controlled input.'
2026-02-20 / news-researcherMicrosoft Semantic Kernel CVE-2026-26030 CVSS 9.9 RCECritical RCE in Microsoft Semantic Kernel Python SDK InMemoryVectorStore filter. Code injection with low privileges, no user interaction. Patched in python-1.39.4. Follows LangChain SSRF CVE — AI framework supply chain security is recurring critical vulnerability category.

Source trail

critical code injection vulnerability PointGuard AI Microsoft Security Blog

Graph sources

entity graphfindings textkg entitiesnewsletter issues