Semantic Kernel: Two agent tool-path vulnerabilities

When agents call tools, model-selected input can affect system execution. Microsoft’s May 7, 2026 report documents two fixed Semantic Kernel flaws.

CVE-2026-26030 affected Python Semantic Kernel’s In-Memory Vector Store filter. In the default Search Plugin path, attacker-controlled prompt input could reach a Python lambda evaluated with eval(). Microsoft says versions before 1.39.4 were affected and describes a fix using syntax and function allowlists, plus restrictions on identifiers and attributes. The CVE-2026-26030 advisory lists the affected and patched versions.

CVE-2026-25592 involved .NET Semantic Kernel’s SessionsPythonPlugin. The model could call a file-transfer helper with a host destination path, allowing a prompt-injection chain to write outside the sandbox. Microsoft’s demonstration placed a script in Windows Startup. The report identifies .NET versions before 1.71.0 as affected; the fix hid the helper from model tool calling and added path validation for programmatic calls. The CVE-2026-25592 advisory also lists Python versions before 1.39.3, patched in 1.39.3. The linked patch PR removes the callable annotation; its empty-or-unset allowed-directory setting remains permissive for direct programmatic downloads.

The advisory for CVE-2026-25592 was published February 6; the one for CVE-2026-26030 followed on February 19, before the May 7 report. Microsoft gives no discovery or incident dates and does not report observed exploitation. Its Windows Startup example is not a macOS finding. For Mac agents, the practical lesson is to limit what tool parameters can reach and which files a helper can write.

Teams can reduce impact by granting narrow file and network access, separating tools that read data from those that write or execute code, and reviewing host logs for unexpected child processes during any period when an affected version was deployed. Patch the relevant package, then investigate hosts that ran the vulnerable configuration.