The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Two separate Semantic Kernel vulnerabilities show how prompt injection can cross an agent’s tool boundary—but only in specific configurations. CVE-2026-26030 affects Python deployments using the Search Plugin with the default In-Memory Vector Store filter functionality; CVE-2026-25592 concerns a .NET plugin function that could write a sandbox file to a host path. Update the affected packages, check whether the vulnerable components were deployed, and investigate the agent host if past exposure is possible.
Am I affected?
Check each language SDK and deployment separately. The two CVEs affect different components and have different prerequisites; using Semantic Kernel, or accepting untrusted prompt content, does not by itself establish exposure.
As an Amazon Associate I earn from qualifying purchases.
| Issue | SDK and component | Exposure condition | Direct primitive | Fixed version |
|---|---|---|---|---|
| CVE-2026-26030 | Python package semantic-kernel |
Search Plugin backed by the default In-Memory Vector Store filter functionality, with model-influenced tool input | Model-controlled filter input reaches Python eval(), enabling a crafted route to host command execution |
1.39.4 or later |
| CVE-2026-25592 | .NET package Microsoft.SemanticKernel.Plugins.Core, specifically SessionsPythonPlugin |
The AI-callable DownloadFileAsync helper can be invoked in a way that writes a sandbox file to a host path |
Host-side arbitrary file write; the illustrated chain can have an RCE consequence, but the helper does not execute code in every environment | 1.71.0 or later |
Microsoft’s May 7, 2026 technical account describes the exploit mechanics and deployment conditions. The corresponding GitHub advisories identify the affected packages and release thresholds. For CVE-2026-26030, the advisory marks the issue Critical, gives a CVSS 3.1 score of 9.9, and classifies it as CWE-94 code injection. For CVE-2026-25592, it likewise gives 9.9 and classifies the issue as CWE-22 path traversal. Those scores express assessed severity, not the likelihood of exploitation or the number of affected systems.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPython: check the search and vector-store configuration
Inventory the exact semantic-kernel version and determine whether the Search Plugin uses the default In-Memory Vector Store filter functionality. Then assess whether untrusted or attacker-influenced content could affect the model’s tool arguments. The documented Python exposure depends on this combination; it is not a claim that every Python Semantic Kernel application is vulnerable.
#1 Best Overall
.NET: check use of SessionsPythonPlugin
Inventory Microsoft.SemanticKernel.Plugins.Core and identify applications that use SessionsPythonPlugin. The documented route involves exposing DownloadFileAsync to AI function calling, allowing model-directed file transfer from an isolated Azure Container Apps dynamic session to a host path.
Can a prompt injection really execute code on the agent host?
It can contribute to an exploit chain when a vulnerable tool accepts model-controlled values without safe boundary validation. Prompt injection is the source of attacker influence in these examples; the technical failures are the framework’s handling of a filter expression in one case and a host-side file path in the other. Microsoft’s Security Research Team summarized the underlying issue this way: “The vulnerability lies in how the framework and tools trust the parsed data.”
CVE-2026-26030: a Python filter becomes executable input
In Microsoft’s hotel-search example, an agent invokes a Search Plugin backed by an In-Memory Vector Store. A filter is built as a Python lambda using a value that can be influenced through model tool arguments, then evaluated with eval(). A validator was present, but it relied on a blacklist and structural checks. Python’s flexible object and AST mechanisms enabled a crafted input to bypass those checks and reach arbitrary host command execution.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The critical qualification is the documented setup: the relevant Search Plugin and default In-Memory Vector Store filter functionality, plus a prompt-injection vector that influences tool input. A prompt injection without that vulnerable path is not equivalent to this CVE.
Rank #3
CVE-2026-25592: a file-transfer helper crosses the host boundary
The .NET SessionsPythonPlugin was designed to move files between an isolated Azure Container Apps dynamic session and the host agent. In the vulnerable version, DownloadFileAsync was exposed as an AI-callable kernel function. Injected instructions could direct the model to use that helper to write a file from the sandbox to a dangerous host location. That creates a file-write primitive that can undermine isolation; the illustrated chain can lead to code execution, but a file write is not itself proof that code ran.
What versions fix the flaws?
- Python CVE-2026-26030: upgrade
semantic-kernelto1.39.4or later. The GitHub advisory lists versions below1.39.4as affected. It also suggests avoiding InMemoryVectorStore in production as a workaround. - .NET CVE-2026-25592: upgrade
Microsoft.SemanticKernel.Plugins.Coreto1.71.0or later; the advisory lists earlier versions as affected.
The CVE-2026-25592 advisory also lists a Python package range below 1.39.3, with 1.39.3 as the patch for that advisory’s Python implementation. That is a distinct package-specific advisory detail: for the Python filter flaw CVE-2026-26030, use its later fix threshold, 1.39.4 or later.
Microsoft describes separate code fixes. For the Python filter, the fix adds layered validation: an AST-node allowlist, an allowlist for function calls, restrictions on dangerous attributes, and limits on bare identifier names. For the .NET file-write route, it removes the [KernelFunction] exposure so the model cannot call DownloadFileAsync, and adds host-path validation for programmatic calls.
What should I do if I cannot upgrade immediately?
Python
Microsoft’s advisory workaround is to avoid using InMemoryVectorStore in production. Review the affected Search Plugin configuration and prevent model-controlled values from reaching vulnerable filter evaluation while arranging the package update. Do not treat prompt wording alone as a substitute for fixing the vulnerable code path.
Best Value
.NET
The advisory describes a function invocation filter that checks calls to DownloadFileAsync or UploadFileAsync and allowlists the localFilePath argument. Microsoft’s technical account also emphasizes path canonicalization and directory allowlisting. Apply validation at the host boundary so a model-supplied path cannot escape the intended directory; then upgrade to the fixed package.
How do I check whether it was exploited before I patched?
- Bound the exposure window. For every deployment, record when the affected package and vulnerable configuration were present, and when the fixed version or mitigation took effect. Keep Python and .NET timelines separate.
- Review agent-host telemetry for that period. Microsoft recommends looking for suspicious child processes, outbound connections, and persistence artifacts associated with the host running the agent.
- Investigate the host and its reach. If findings are suspicious, treat the host as potentially compromised. Inspect it, rotate tokens and credentials available to the agent, and assess the systems and data that the agent could reach.
A telemetry review can help identify suspicious activity, but the cited guidance does not establish that a clean review proves exploitation did not occur. The appropriate response depends on the host’s evidence and access.
What these two flaws say about agent tool boundaries
Both cases point to the same engineering discipline without sharing the same fix: validate every tool argument where it crosses into a privileged operation. A filter expression must not become executable code merely because it arrived through a model’s tool call. A file helper must not trust a host path supplied through an AI-callable function. Microsoft Learn’s broader prompt-injection guidance says content inserted into prompts should be treated as unsafe by default; that principle complements, but does not replace, the CVE-specific package updates and boundary checks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
