Microsoft Semantic Kernel Prompt-Injection-to-RCE & Arbitrary File Write — CVE-2026-26030 (InMemoryVectorStore eval) + CVE-2026-25592 (SessionsPythonPlugin)

Microsoft Semantic Kernel Prompt-Injection-to-RCE & (TL-2026-0489), also tracked as Semantic Kernel Prompt-Shells, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-05-09. It has no confirmed attribution, affects Microsoft Semantic Kernel Python SDK, references 2 CVEs (CVE-2026-26030, CVE-2026-25592), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0489

Threat ID
TL-2026-0489
Also known as
Semantic Kernel Prompt-Shells, SK Eval-RCE, Semantic Kernel May 2026 Disclosure
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-09
Last reviewed
2026-05-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, financial, government, healthcare, legal, manufacturing, retail, education, energy
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
22

Microsoft disclosed two critical (CVSS 9.9) vulnerabilities in its Semantic Kernel AI agent framework on 2026-05-07. CVE-2026-26030 turns prompt injection into host-level RCE by abusing a Python eval()-backed default filter in the Python SDK's InMemoryVectorStore; CVE-2026-25592 enables arbitrary file write in the .NET SDK's SessionsPythonPlugin via path traversal in the upload_file API. A single attacker-controlled prompt is enough to launch arbitrary code (calc.exe in Microsoft's PoC) on the agent host. Fixed in Semantic Kernel python-1.39.4 and Microsoft.SemanticKernel.Core 1.71.0.

How Microsoft Semantic Kernel Prompt-Injection-to-RCE & works

Microsoft Security Research disclosed two CVSS 9.9 critical vulnerabilities in Semantic Kernel — Microsoft's flagship open-source agent orchestration framework with 27,000+ GitHub stars and broad use across Microsoft Copilot Studio, Azure AI Foundry, and third-party enterprise AI agents. The disclosure inaugurates a new Microsoft research series targeting agent-framework security; LangChain and CrewAI are publicly flagged as the next research targets.

=== CVE-2026-26030 — Python SDK InMemoryVectorStore eval() RCE ===

The Python SDK's InMemoryVectorStore class accepts a string-form default filter expression (the ``filter`` argument to ``search()`` and ``vectorized_search()``) and lowers it to a runtime-callable predicate via Python's built-in eval(). Microsoft's intent was to support short, JS-like comparison filters (e.g., ``record.tag == 'public'``) that LLMs could synthesize at runtime. To gate dangerous syntax, the SDK ran the filter string through an AST visitor that blocked Name nodes such as ``__import__``, ``eval``, ``exec``, ``open``, ``compile``, and a curated list of builtin attributes.

The blocklist is bypassable. Because the AST visitor only matches direct Name nodes and a handful of Attribute names, an attacker can reach arbitrary builtins through indirect access patterns that the validator never normalizes:

* ``().__class__.__base__.__subclasses__()[N]`` — classic Python sandbox escape via the object subclass tree, which the validator does not flatten. * ``getattr(getattr(record, '__class__'), '__init__').__globals__['__builtins__']`` — globals reach via attribute chains. * ``[c for c in ().__class__.__mro__[-1].__subclasses__() if c.__name__ == 'BuiltinImporter'][0]`` — list comprehensions whose generator expressions execute under eval()'s scope. * ``type(lambda:0)('x','x',(object,),{}).__init_subclass__.__self__.__subclasses__()`` — type() construction.

With any of these, the attacker pivots to ``os.system`` / ``subprocess.Popen`` / ``importlib.import_module`` and obtains arbitrary command execution under the agent host's identity. The payload runs synchronously inside the agent's Python process, so it inherits whatever credentials, mounted secrets, Azure managed identity, or vector-store data the agent has access to.

Attack vector: the filter string is frequently produced by the LLM itself (for retrieval-augmented generation flows where the model reasons about which documents to retrieve and emits the filter as a tool argument). Any prompt-injection vector — direct user input, document content fed into the agent, web-page content scraped by a tool, email body, calendar event, knowledge-base record — that can influence the model's tool argument synthesis can therefore drive RCE. Microsoft's blog post demonstrates a one-shot PoC where an attacker emails a malicious document to a Copilot-style agent and the agent runs ``calc.exe`` on the host within a single turn.

=== CVE-2026-25592 — .NET SDK SessionsPythonPlugin Arbitrary File Write ===

The .NET SDK ships a SessionsPythonPlugin that lets agents create, list, delete, upload, and download files inside an Azure Container Apps Dynamic Sessions Python sandbox. The ``UploadFileAsync`` method takes a remote file path as a string argument and forwards it to the Sessions REST API without canonicalization. The remote path is interpreted relative to the session's ``/mnt/data`` working directory, but the plugin does not strip ``..`` segments, reject absolute paths, or constrain the destination to ``/mnt/data``.

An attacker that can influence the plugin's ``remote_file_path`` argument (again, typically by prompt injection that controls the LLM's tool-call arguments) can write attacker-controlled bytes to any path the Sessions service can reach: ``/etc/cron.d/`` for a scheduled command, ``/root/.ssh/authorized_keys`` for persistence, ``/usr/local/lib/python3.11/site-packages/<existing>.py`` to backdoor a library imported by the next session, or ``../../app/Startup.dll`` to corrupt the agent process itself. Because Dynamic Sessions reuses session pods within configured TTLs, write-then-trigger chains are practical.

While classed as arbitrary file write rather than RCE, chained with the SessionsPythonPlugin's own execute-code primitive (which runs Python in the sandbox) the bug yields persistence and trivial sandbox escape: write a malicious .pth file or shadow a system module, then issue any execute call that imports the shadowed name.

=== Combined Impact ===

Both bugs share a root cause: AI agent frameworks treat LLM-emitted strings — filter expressions, tool arguments, paths — as trusted control-plane data when they are in fact untrusted attacker-influenced data. The blast radius is the entire agent host: Azure managed-identity tokens, mounted secret stores, vector databases (often containing customer data ingested for RAG), backend APIs callable through other tools, and any persistence the agent process has on disk. Because Semantic Kernel underpins Microsoft Copilot Studio and many Azure AI Foundry templates, exposure extends to enterprise tenants who built agents on top of the framework without auditing.

Microsoft has not published in-the-wild exploitation telemetry, but classifies the CVEs as ``Exploitation More Likely`` given the trivial PoC, network attack vector, and the rapidly growing surface of internet-facing agent endpoints.

=== Fixes ===

* Python: ``semantic-kernel >= 1.39.4`` removes eval() and replaces the string-filter pathway with a typed expression compiler that only emits comparison and boolean operations. * .NET: ``Microsoft.SemanticKernel.Core >= 1.71.0`` and the Sessions plugin packages canonicalize remote paths, reject ``..`` and absolute paths, and constrain writes to ``/mnt/data``. * Microsoft also recommends running agent processes under least-privileged service identities, isolating vector-store hosts from production secrets, and treating LLM-emitted tool arguments as untrusted input subject to allow-list validation.

MITRE ATT&CK techniques used in TL-2026-0489

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1106 Native API; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Persistence

T1505 Server Software Component

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

stealth

T1574 Hijack Execution Flow

Affected products and versions in Microsoft Semantic Kernel Prompt-Injection-to-RCE &

  • Microsoft — Semantic Kernel Python SDK
    Vulnerable versions: < 1.39.4
    Fixed in: 1.39.4; 1.40.x; 1.41.x
  • Microsoft — Microsoft.SemanticKernel.Core (.NET)
    Vulnerable versions: < 1.71.0
    Fixed in: 1.71.0
  • Microsoft — Microsoft.SemanticKernel.Plugins.Sessions (.NET)
    Vulnerable versions: < 1.71.0
    Fixed in: 1.71.0
  • Microsoft — Copilot Studio (custom agents using vulnerable Semantic Kernel builds)
    Vulnerable versions: custom-agent builds linking SK < 1.39.4 / < 1.71.0
    Fixed in: rebuild with patched SK packages

Remediation for Microsoft Semantic Kernel Prompt-Injection-to-RCE &

Patches

  • Semantic Kernel Python SDK 1.39.4 (PyPI: semantic-kernel) — removes eval() from InMemoryVectorStore.
  • Microsoft.SemanticKernel.Core 1.71.0 (NuGet) — path canonicalization in SessionsPythonPlugin.
  • Microsoft.SemanticKernel.Plugins.Sessions 1.71.0 (NuGet) — same fix shipped in the plugin package.

Immediate actions

  • Upgrade Semantic Kernel Python SDK to >= 1.39.4 across all agent hosts and CI images.
  • Upgrade Microsoft.SemanticKernel.Core and Microsoft.SemanticKernel.Plugins.Sessions to >= 1.71.0 in all .NET agent solutions.
  • Audit all uses of InMemoryVectorStore.search(filter=...) and replace string filters with the typed FilterExpression API.
  • Audit all calls to SessionsPythonPlugin.UploadFileAsync and reject any remote_file_path containing '..', leading '/', or characters outside [A-Za-z0-9_.-/].
  • Rotate Azure managed-identity credentials, vector-store API keys, and any secrets accessible from agent hosts that ran vulnerable versions and were exposed to untrusted prompts.

Workarounds

  • Until upgrade is possible, avoid passing LLM-generated filter strings to InMemoryVectorStore.search; pre-compute filters from typed user input only.
  • Disable SessionsPythonPlugin.UploadFileAsync, or wrap it with a host-side path validator that rejects '..' and absolute paths before invocation.
  • Place a content-security proxy in front of any agent endpoint that strips dunder attribute access (__class__, __subclasses__, __globals__, __builtins__, __import__) from prompts and tool arguments.
  • Move the agent process into a network-segmented container with no outbound internet egress and no access to host secrets, limiting the blast radius of any successful RCE.

Longer-term hardening

  • Treat every LLM-emitted tool argument as untrusted input: enforce allow-list validation on the agent side before passing to any plugin.
  • Deploy prompt-injection-aware logging for tool calls; alert on filter strings or paths containing dunder attributes, '..' segments, or builtin names.
  • Run agent processes under dedicated least-privileged identities with no broad cloud RBAC; isolate from CI/CD secrets and production write paths.
  • Adopt agent-side sandboxing (gVisor, Firecracker, Azure Container Apps Dynamic Sessions with correctly enforced path scoping) for any plugin that touches the filesystem or executes code.
  • Subscribe to Microsoft's agent-framework security research series and re-audit plugins quarterly as new vulnerability classes land.

CVEs associated with Microsoft Semantic Kernel Prompt-Injection-to-RCE &

CVE-2026-26030, CVE-2026-25592

Weaknesses (CWE) in Microsoft Semantic Kernel Prompt-Injection-to-RCE &

CWE-95, CWE-94, CWE-22, CWE-73, CWE-1336

Timeline of Microsoft Semantic Kernel Prompt-Injection-to-RCE &

  • Microsoft Security Research internally discovered the eval()-backed filter pathway in Semantic Kernel Python InMemoryVectorStore and the path-traversal weakness in the .NET SessionsPythonPlugin during an agent-framework audit.
  • Microsoft Red Team reproduced one-shot prompt-injection-to-RCE chain on a Copilot-style demo agent: malicious email document drives the LLM to emit a filter string that escapes the AST blocklist via __subclasses__() and spawns calc.exe on the agent host.
  • Patches developed: typed FilterExpression compiler replaces eval() in the Python SDK; remote-path canonicalization added to SessionsPythonPlugin in the .NET SDK.
  • CVE-2026-26030 and CVE-2026-25592 reserved with MITRE; coordinated disclosure timeline locked with the Semantic Kernel maintainers.
  • Semantic Kernel python-1.39.4 released to PyPI; Microsoft.SemanticKernel.Core 1.71.0 and Microsoft.SemanticKernel.Plugins.Sessions 1.71.0 released to NuGet.
  • Microsoft Security Blog published 'When prompts become shells: RCE vulnerabilities in AI agent frameworks'; NVD entries published; CVSS 9.9 critical.
  • Public technical discussion in security communities; independent researchers reproduced the AST blocklist bypass using __subclasses__() chains and published walkthroughs.
  • Threadlinqs Intelligence opened TL-2026-0489. Detection rules being authored across Splunk, Microsoft Sentinel KQL, and Sigma. No in-the-wild exploitation telemetry confirmed yet; Microsoft classifies as Exploitation More Likely.
  • As of 2026-05-29, both Semantic Kernel CVEs (CVE-2026-26030, CVE-2026-25592) are patched (semantic-kernel 1.39.4 / SemanticKernel.Core 1.71.0) with no confirmed in-the-wild exploitation and no CISA KEV listing. They remain a live concern: public PoC/AST-bypass walkthroughs exist, Microsoft rates them Exploitation More Likely, and unpatched agent hosts stay exposed.

Sources cited for Microsoft Semantic Kernel Prompt-Injection-to-RCE &

Threats related to Microsoft Semantic Kernel Prompt-Injection-to-RCE &

Detection coverage for TL-2026-0489

As of 2026-05-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0489 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats