CVE-2026-26030: Microsoft Semantic Kernel RCE in InMemoryVectorStore filter

Executive brief

A critical security vulnerability has been found in the Microsoft Semantic Kernel Python SDK, a tool used for building AI-driven applications. An attacker could exploit this flaw to execute malicious code on the server hosting the application. This could lead to a complete system takeover, unauthorized access to sensitive data, or disruption of business operations.

Technical details

A remote code execution (RCE) vulnerability exists in the Microsoft Semantic Kernel Python SDK due to improper control of code generation (CWE-94) within the `InMemoryVectorStore` filter functionality. The root cause involves the use of dangerous attribute names in filter expressions that are not properly neutralized. A remote attacker with low privileges can exploit this over a network without user interaction to execute arbitrary code. The vulnerability is addressed in version 1.39.4 by blocking access to dangerous attribute names in filter expressions.

Affected products

• Microsoft semantic-kernel < 1.39.4

Timeline

• 2026-02-19: disclosed
• 2026-02-19: patched: Fixed in version 1.39.4
• 2026-02-19: advisory

References

• https://api.github.com/users/amiteliahu
• https://github.com/amiteliahu
• https://api.github.com/users/amiteliahu/gists%7B/gist_id%7D
• https://api.github.com/users/amiteliahu/repos
• https://avatars.githubusercontent.com/u/257952426?v=4
• https://api.github.com/users/amiteliahu/events%7B/privacy%7D