KLA90920 Multiple vulnerabilities in Microsoft Open Source Software

Multiple vulnerabilities were found in Microsoft Open Source Software. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability can be exploited remotely to...

Microsoft Semantic Kernel Code Injection Vulnerability

Microsoft Semantic Kernel is a large model orchestration framework from Microsoft Corporation, USA. A code injection vulnerability exists in Microsoft Semantic Kernel versions prior to 1.39.4. The vulnerability stems from the InMemoryVectorStore filtering feature failing to properly filter specia...

Exploit for CVE-2026-26030

Microsoft Semantic Kernel BPassed to VectorStore query/filte...

CVE-2026-26030

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...

pyrit (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-26030 via semantic-kernel (0.9.4b1)

semantic-kernel PYPI version 0.9.4b1 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - pyrit =0.2.0, =0.2.1 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agentic-kernel (>=0.1.0, <=0.1.10), co-op-translator (>=0.1.1, <=0.5.1) +4 more potentially affected by CVE-2026-26030 via semantic-kernel (>=1.3.0, <=1.35.3)

semantic-kernel PYPI version =1.3.0, =0.1.0, =0.1.1, =0.8.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 Source cves: CVE-2026-26030 Source advisory: SNYK:PYTHON-SEMANTICKERNEL-15323118...

agixt (>=1.2.3, <=1.2.13) potentially affected by CVE-2026-26030 via semantic-kernel (0.2.9.dev0)

semantic-kernel PYPI version 0.2.9.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt =1.2.3, =1.2.13 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agixt (>=1.1.76b0, <=1.2.1b0) potentially affected by CVE-2026-26030 via semantic-kernel (0.3.0.dev0)

semantic-kernel PYPI version 0.3.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt =1.1.76b0, =1.2.1b0 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agixt (>=1.2.14, <=1.3.58) potentially affected by CVE-2026-26030 via semantic-kernel (0.3.1.dev0)

semantic-kernel PYPI version 0.3.1.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt =1.2.14, =1.3.58 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agixt (>=1.3.59, <=1.3.70) potentially affected by CVE-2026-26030 via semantic-kernel (0.3.4.dev0)

semantic-kernel PYPI version 0.3.4.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt =1.3.59, =1.3.70 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agixt (1.3.71) potentially affected by CVE-2026-26030 via semantic-kernel (0.3.7.dev0)

semantic-kernel PYPI version 0.3.7.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt 1.3.71 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

gptui (0.1.0) potentially affected by CVE-2026-26030 via semantic-kernel (0.3.15.dev0)

semantic-kernel PYPI version 0.3.15.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - gptui 0.1.0 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

sonagent (>=1.0.0, <=1.0.9) potentially affected by CVE-2026-26030 via semantic-kernel (0.4.5.dev0)

semantic-kernel PYPI version 0.4.5.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - sonagent =1.0.0, =1.0.9 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agentic-kernel (>=0.1.0, <=0.1.10), co-op-translator (>=0.1.1, <=0.5.1) +4 more potentially affected by CVE-2026-26030 via semantic-kernel (>=1.3.0, <=1.35.3)

semantic-kernel PYPI version =1.3.0, =0.1.0, =0.1.1, =0.8.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 Source cves: CVE-2026-26030 Source advisory: OSV:GHSA-XJW9-4GW8-4RQX...

agentic-kernel (>=0.1.0, <=0.1.10), co-op-translator (>=0.1.1, <=0.5.1) +4 more potentially affected by CVE-2026-26030 via semantic-kernel (>=1.3.0, <=1.35.3)

semantic-kernel PYPI version =1.3.0, =0.1.0, =0.1.1, =0.8.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 Source cves: CVE-2026-26030 Source advisory: GHSA-XJW9-4GW8-4RQX...

Arbitrary Code Injection

Overview semantic-kernel is a Semantic Kernel Python SDK Affected versions of this package are vulnerable to Arbitrary Code Injection via the InMemoryVectorStore filter functionality due to lack of filtering for dangerous dunder attributes. An attacker can escape the sandbox and execute arbitrary...

GHSA-XJW9-4GW8-4RQX Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Impact: An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. Patches: The problem has been fixed in python-1.39.4. Users should upgrade this version or higher. Workarounds: Avoid using InMemoryVectorSto...

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Impact: An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality. Patches: The problem has been fixed in python-1.39.4. Users should upgrade this version or higher. Workarounds: Avoid using InMemoryVectorSto...

agixt (>=1.2.3, <=1.2.13) potentially affected by CVE-2026-26030 via semantic-kernel (0.2.9.dev0)

semantic-kernel PYPI version 0.2.9.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-kernel and may be impacted: - agixt =1.2.3, =1.2.13 Source cves: CVE-2026-26030 Source advisory: OSV:PYSEC-2026-163...

PYSEC-2026-163

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a...