Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
A flaw in Microsoft Semantic Kernel's SessionsPythonPlugin lets code executed inside its sandbox write files to arbitrary host paths, including the folders Windows, Linux, and cron use to auto-run programs. This turns a contained code-execution sandbox into a way to run code on the host every time it restarts.
How the attack works
An attacker with the ability to run code through the plugin's ExecuteCode feature first generates a malicious payload inside the sandbox. They then call the plugin's file download function (DownloadFileAsync) with a path that is not validated, aiming it at a startup location such as the Windows Startup folder, a cron entry, or a systemd-user path. The file lands outside the intended sandbox boundary. On the next reboot or login, the operating system automatically executes the planted file, giving the attacker code execution outside the sandbox with no further interaction needed.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a628b09c-38ca-4404-922e-760ee50bc080
- Severity
- Critical
- CVEs
- CVE-2026-25592
Why it matters
An attacker who can already run code through this plugin gains persistent, unsandboxed control of the host machine, surviving reboots and bypassing the isolation the sandbox was meant to provide.
What you can do
- →Upgrade Semantic Kernel to Python >= 1.39.4 or .NET >= 1.71.0, which validate and canonicalise file paths before writing.
- →Until patched, restrict or disable the SessionsPythonPlugin's file-write/download capability, or run it with a filesystem allowlist that excludes startup, cron, and systemd-user directories.
- →Review tool/plugin descriptors granted to agents for excessive file-system privileges and remove any that are not strictly needed.
- →Monitor for file writes targeting Startup folders, crontab, or systemd-user paths originating from agent or sandbox processes, even after patching, as defence in depth.
Known benign look-alikes
- Legitimate developer documentation referencing Windows Startup folder for non-malicious use cases (installer behaviour, productivity software).
- Detection rule corpora (this repo, SigmaHQ, MISP) documenting CVE-2026-25592 patterns for defensive purposes.
- Patched SessionsPythonPlugin deployments that perform path-canonicalisation and reject autostart targets before write.
- Benign discussion of process / app / shell `startup` in English prose without a path or file-write context.