Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
A critical vulnerability in Microsoft Semantic Kernel lets an attacker run arbitrary system commands on the host by feeding a crafted text expression into the framework's In-Memory Vector Store filter feature. The flaw exists because the filter code treats attacker-controlled or LLM-generated text as executable code instead of data.
How the attack works
Semantic Kernel's In-Memory Vector Store filter feature takes a filter expression and evaluates it as a Python lambda. An attacker crafts input — either direct user input or text an LLM has generated after being manipulated — that looks like a lambda but actually walks Python's internal class hierarchy (using tricks like tuple() and __mro__) to reach the module importer and call os.system(). Because the input reaches an eval() call without safe parsing, this gives the attacker unauthenticated remote code execution on the server hosting the agent. The rule looks for these lambda/eval/import-chain patterns appearing in content or user-input fields that a Semantic Kernel agent would pass into the filter sink.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 631647ed-c432-4293-aab5-b2bcbdc008f5
- Severity
- Critical
- CVEs
- CVE-2026-26030
Why it matters
A successful exploit gives an attacker full command execution on the machine running the Semantic Kernel agent, which can lead to data theft, lateral movement, or complete host compromise — all without needing valid credentials.
What you can do
- →Upgrade to Semantic Kernel Python >= 1.39.4 or .NET >= 1.71.0, which reject unsafe lambda bodies via AST allowlisting.
- →Until patched, do not let LLM output or unsanitized user input reach vector store filter expressions; validate or restrict filter syntax to safe field comparisons only.
- →Review logs for filter inputs containing lambda definitions, eval, __import__, or class-hierarchy traversal patterns (e.g. __mro__, __subclasses__).
- →Run Semantic Kernel agent processes with least-privilege system accounts so that even a successful exploit has limited command execution impact.
Known benign look-alikes
- Legitimate Python educational content discussing lambda safety or eval() risks.
- Static analysis tooling output documenting CVE-2026-26030 attack patterns for defensive purposes.
- Patched Semantic Kernel filter expressions that use AST allowlisting and reject lambda bodies before evaluation.