Loading vulnerability…
CVE-2026-26030 is a remote code execution vulnerability in Microsoft Semantic Kernel's Python SDK affecting versions prior to 1.39.4. The flaw is in the InMemoryVectorStore filter functionality used by the Search Plugin. According to the provided content, the vulnerable code path constructs a Python lambda expression from AI model- or attacker-influenced filter input using unsafe string interpolation and then executes it with eval(). Although the implementation included AST-based validation intended to block dangerous identifiers, that validation could be bypassed with crafted input. Researchers reported that exploitation could use Python class hierarchy traversal to reach BuiltinImporter, dynamically load os, and invoke system(), resulting in arbitrary command execution on the host running the agent.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a self-contained lab and proof-of-concept exploit for CVE-2026-26030 affecting Microsoft Semantic Kernel for Python before 1.39.4. It demonstrates prompt-influenceable remote code execution through the in-memory vector store filter parser, where attacker-controlled filter strings are compiled and evaluated. The exploit abuses two validation weaknesses: unrestricted `ast.Attribute` traversal enables dunder walking, and the call validator skips enforcement when the callable is wrapped as a `Subscript`, allowing constructs like `[obj.method][0](args)`. The chain reaches `object.__subclasses__()`, locates `BuiltinImporter`, loads `os`, and invokes `os.system()`. Repository structure: `exploit.py` is the main end-to-end PoC, creating a real `InMemoryCollection`, inserting sample hotel records, generating the malicious lambda payload dynamically, and confirming exploitation by creating `/tmp/pwned_by_filter`. `probe.py` is a smaller validator-focused bypass demonstration that directly exercises `_parse_and_validate_filter`. `find_sink.py` is a helper script to locate the real `eval`/`compile` sink in the installed Semantic Kernel package. `run.sh` executes the same exploit against both a vulnerable (`.venv`, 1.39.3) and patched (`.venv-patched`, 1.39.4) environment for comparison. `setup.sh` provisions those isolated virtual environments. The `demo-ui/` directory contains a live web demonstration: `demo-ui/app.py` is a FastAPI application that builds a Groq-backed Llama agent via Semantic Kernel. The agent exposes a `search_hotels(city)` tool that unsafely interpolates the model-supplied `city` into a filter string. An attacker message is prebuilt to coerce the model into passing a malicious city value, causing the vulnerable filter path to execute `open -a Calculator` on the host while the agent still returns hotel results. `demo-ui/index.html` is the browser UI that loads the attacker seed message, posts to `/chat`, and displays whether RCE fired. `demo-ui/run.sh` launches the local server on 127.0.0.1:8000. Overall, this is a real exploit repository rather than a detector. It contains both a headless PoC and an interactive web demo, with harmless but functional payloads proving arbitrary command execution under the current user context.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Microsoft Semantic Kernel where prompt injection could lead to remote code execution.
A Microsoft Semantic Kernel vulnerability referenced as evidence that LLMs are not security boundaries.
A vulnerability in Microsoft's Semantic Kernel referenced as demonstrating risks tied to locally trusted execution paths in AI agent ecosystems.
A Semantic Kernel remote code execution issue referenced as related prior research involving localhost trust assumptions.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.