← Back to feed
2026-05-09 Malicious Tool TLP:CLEAR

Semantic Kernel CVE-2026-26030: Prompt Injection to RCE in Microsoft AI Agent Framework—eval() Filter Vulnerability Affects Python SDK < 1.39.4

Date: 2026-05-09
Tags: malicious-tool, prompt-injection

Executive Summary

Microsoft disclosed on May 7, 2026, that two patched vulnerabilities in its Semantic Kernel agent framework could let prompt injection become remote code execution or arbitrary host file writes in affected Python and .NET agent deployments. CVE-2026-26030 affected the Python Semantic Kernel package before version 1.39.4 under specific conditions. An agent had to use the In-Memory Vector Store as backend for a Search Plugin with default filtering behavior; when those conditions aligned, a single crafted prompt could lead to host-level remote code execution.

Campaign Summary

FieldDetail
Campaign / MalwareSemantic Kernel Python Agent Framework RCE Vulnerability
AttributionVulnerability (not attributed to threat actor) (confidence: none)
TargetOrganizations deploying Python-based AI agents with Semantic Kernel < 1.39.4, especially those using InMemoryVectorStore with default configuration
VectorPrompt injection → eval() code execution in filter expressions
Statusactive
First Observed2026-02-19

Detailed Findings

The default filter was built as a Python lambda expression and executed with eval(), with the city value interpolated into the expression. The payload breaks out of the filter string and walks Python's MRO: () → tuple → object → __subclasses__() → BuiltinImporter → os.system(). calc.exe (or any arbitrary command) executes on the host. The second vulnerability, CVE-2026-25592, affected the .NET Semantic Kernel SDK before version 1.71.0, centered on SessionsPythonPlugin allowing agents to execute Python code inside Azure Container Apps. DownloadFileAsync was accidentally exposed to the model as a callable kernel function, and without adequate path validation, a hostile prompt could steer the agent into writing a file somewhere dangerous.

MITRE ATT&CK Mapping

TechniqueIDContext
Prompt InjectionT1598Attacker crafts input to agent that bypasses model filtering and injects code execution commands
Code InjectionT1059Python eval() sink executes attacker-controlled code via filter expression
ExecutionT1059.001os.system() and arbitrary Python code execution via deserialization

IOCs

Domains

_Vulnerability tracking; affected package versions are the primary IOC_

Full URL Paths

_Vulnerability tracking; affected package versions are the primary IOC_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

semantic-kernel<1.39.4 (Python)
semantic-kernel<1.71.0 (.NET)

Detection Recommendations

Inventory all Semantic Kernel deployments and immediately upgrade Python SDK to ≥1.39.4 and .NET SDK to ≥1.71.0. Monitor for eval() calls in filter expressions in agent logs. Implement prompt input validation and sanitization before passing to Search Plugin. Avoid InMemoryVectorStore in production; use production-grade vector databases. Implement code execution sandboxing for agent operations. Monitor for unexpected file writes or system command execution from Python agent processes.

References