A Prompt Injection Turned Into a Shell: Inside Semantic Kernel's Two RCE CVEs
Microsoft disclosed CVE-2026-26030 and CVE-2026-25592 in the Semantic Kernel framework: LLM output was passed to eval() in a vector search filter and to a file download path without validation, allowing code execution. Fixes were released in Python SDK 1.39.4 and .NET SDK 1.71.0.
- CVE-2026-26030: search filter in Python SDK evaluated via eval() and bypassed blocklist
- CVE-2026-25592: DownloadFileAsync in .NET SDK wrote file to any folder, including Startup
- Fixes: semantic-kernel 1.39.4 for Python and .NET SDK 1.71.0
- Microsoft demonstrated launching calc.exe on a machine with the agent
Read next
Security