# Microsoft Semantic Kernel Prompt-Injection-to-RCE & Arbitrary File Write — CVE-2026-26030 (InMemoryVectorStore eval) + CVE-2026-25592 (SessionsPythonPlugin)

> Microsoft disclosed two critical (CVSS 9.9) vulnerabilities in its Semantic Kernel AI agent framework on 2026-05-07. CVE-2026-26030 turns prompt injection into host-level RCE by abusing a Python eval()-backed default filter in the Python SDK's InMemoryVectorStore; CVE-2026-25592 enables arbitrary file write in the .NET SDK's SessionsPythonPlugin via path traversal in the upload_file API. A single attacker-controlled prompt is enough to launch arbitrary code (calc.exe in Microsoft's PoC) on the agent host. Fixed in Semantic Kernel python-1.39.4 and Microsoft.SemanticKernel.Core 1.71.0.

- **Published:** 2026-05-09T12:00:00Z
- **Last reviewed:** 2026-05-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0489
- **ID:** TL-2026-0489
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-26030, CVE-2026-25592

## Description

Microsoft Security Research disclosed two CVSS 9.9 critical vulnerabilities in Semantic Kernel — Microsoft's flagship open-source agent orchestration framework with 27,000+ GitHub stars and broad use across Microsoft Copilot Studio, Azure AI Foundry, and third-party enterprise AI agents. The disclosure inaugurates a new Microsoft research series targeting agent-framework security; LangChain and CrewAI are publicly flagged as the next research targets.

=== CVE-2026-26030 — Python SDK InMemoryVectorStore eval() RCE ===

The Python SDK's InMemoryVectorStore class accepts a string-form default filter expression (the ``filter`` argument to ``search()`` and ``vectorized_search()``) and lowers it to a runtime-callable predicate via Python's built-in eval(). Microsoft's intent was to support short, JS-like comparison filters (e.g., ``record.tag == 'public'``) that LLMs could synthesize at runtime. To gate dangerous syntax, the SDK ran the filter string through an AST visitor that blocked Name nodes such as ``__import__``, ``eval``, ``exec``, ``open``, ``compile``, and a curated list of builtin attributes.

The blocklist is bypassable. Because the AST visitor only matches direct Name nodes and a handful of Attribute names, an attacker can reach arbitrary builtins through indirect access patterns that the validator never normalizes:

  * ``().__class__.__base__.__subclasses__()[N]`` — classic Python sandbox escape via the object subclass tree, which the validator does not flatten.
  * ``getattr(getattr(record, '__class__'), '__init__').__globals__['__builtins__']`` — globals reach via attribute chains.
  * ``[c for c in ().__class__.__mro__[-1].__subclasses__() if c.__name__ == 'BuiltinImporter'][0]`` — list comprehensions whose generator expressions execute under eval()'s scope.
  * ``type(lambda:0)('x','x',(object,),{}).__init_subclass__.__self__.__subclasses__()`` — type() construction.

With any of these, the attacker pivots to ``os.system`` / ``subprocess.Popen`` / ``importlib.import_module`` and obtains arbitrary command execution under the agent host's identity. The payload runs synchronously inside the agent's Python process, so it inherits whatever credentials, mounted secrets, Azure managed identity, or vector-store data the agent has access to.

Attack vector: the filter string is frequently produced by the LLM itself (for retrieval-augmented generation flows where the model reasons about which documents to retrieve and emits the filter as a tool argument). Any prompt-injection vector — direct user input, document content fed into the agent, web-page content scraped by a tool, email body, calendar event, knowledge-base record — that can influence the model's tool argument synthesis can therefore drive RCE. Microsoft's blog post demonstrates a one-shot PoC where an attacker emails a malicious document to a Copilot-style agent and the agent runs ``calc.exe`` on the host within a single turn.

=== CVE-2026-25592 — .NET SDK SessionsPythonPlugin Arbitrary File Write ===

The .NET SDK ships a SessionsPythonPlugin that lets agents create, list, delete, upload, and download files inside an Azure Container Apps Dynamic Sessions Python sandbox. The ``UploadFileAsync`` method takes a remote file path as a string argument and forwards it to the Sessions REST API without canonicalization. The remote path is interpreted relative to the session's ``/mnt/data`` working directory, but the plugin does not strip ``..`` segments, reject absolute paths, or constrain the destination to ``/mnt/data``.

An attacker that can influence the plugin's ``remote_file_path`` argument (again, typically by prompt injection that controls the LLM's tool-call arguments) can write attacker-controlled bytes to any path the Sessions service can reach: ``/etc/cron.d/`` for a scheduled command, ``/root/.ssh/authorized_keys`` for persistence, ``/usr/local/lib/python3.11/site-packages/<existing>.py`` to backdoor a library imported by the next session, or ``../../app/Startup.dll`` to corrupt the agent process itself. Because Dynamic Sessions reuses session pods within configured TTLs, write-then-trigger chains are practical.

While classed as arbitrary file write rather than RCE, chained with the SessionsPythonPlugin's own execute-code primitive (which runs Python in the sandbox) the bug yields persistence and trivial sandbox escape: write a malicious .pth file or shadow a system module, then issue any execute call that imports the shadowed name.

=== Combined Impact ===

Both bugs share a root cause: AI agent frameworks treat LLM-emitted strings — filter expressions, tool arguments, paths — as trusted control-plane data when they are in fact untrusted attacker-influenced data. The blast radius is the entire agent host: Azure managed-identity tokens, mounted secret stores, vector databases (often containing customer data ingested for RAG), backend APIs callable through other tools, and any persistence the agent process has on disk. Because Semantic Kernel underpins Microsoft Copilot Studio and many Azure AI Foundry templates, exposure extends to enterprise tenants who built agents on top of the framework without auditing.

Microsoft has not published in-the-wild exploitation telemetry, but classifies the CVEs as ``Exploitation More Likely`` given the trivial PoC, network attack vector, and the rapidly growing surface of internet-facing agent endpoints.

=== Fixes ===

* Python: ``semantic-kernel >= 1.39.4`` removes eval() and replaces the string-filter pathway with a typed expression compiler that only emits comparison and boolean operations.
* .NET: ``Microsoft.SemanticKernel.Core >= 1.71.0`` and the Sessions plugin packages canonicalize remote paths, reject ``..`` and absolute paths, and constrain writes to ``/mnt/data``.
* Microsoft also recommends running agent processes under least-privileged service identities, isolating vector-store hosts from production secrets, and treating LLM-emitted tool arguments as untrusted input subject to allow-list validation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1059.006 Command and Scripting Interpreter: Python
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1106 Native API
- T1204.002 User Execution: Malicious File
- T1505 Server Software Component
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Microsoft Security Blog — When prompts become shells: RCE vulnerabilities in AI agent frameworks](https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/)
- [NVD — CVE-2026-26030 (Semantic Kernel Python InMemoryVectorStore RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-26030)
- [NVD — CVE-2026-25592 (Semantic Kernel .NET SessionsPythonPlugin Arbitrary File Write)](https://nvd.nist.gov/vuln/detail/CVE-2026-25592)
- [MSRC Advisory — Semantic Kernel May 2026 Patch Notes](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26030)
- [GitHub — microsoft/semantic-kernel python-1.39.4 release](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4)
- [GitHub — microsoft/semantic-kernel dotnet-1.71.0 release](https://github.com/microsoft/semantic-kernel/releases/tag/dotnet-1.71.0)
- [Microsoft AI Red Team — Agent framework threat model (companion paper)](https://www.microsoft.com/en-us/security/blog/2026/05/07/agent-framework-threat-model/)
- [OWASP LLM Top 10 (2025) — LLM01: Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
- [Microsoft AI Red Team — Indirect Prompt Injection in Production Copilots](https://www.microsoft.com/en-us/security/blog/ai-red-team/indirect-prompt-injection-copilots/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0489