9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26030

CVE-2026-26030: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the InMemoryVectorStore filter functionality. The problem has been fixed in version python-1.39.4. Users should upgrade this version or higher. As a workaround, avoid using InMemoryVectorStore for production scenarios.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26030

CVE-2026-26030:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
semantic-kernel	pip	< 1.39.4	1.39.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the InMemoryVectorStore component of the Microsoft Semantic Kernel Python SDK. Specifically, the _parse_and_validate_filter method within the InMemoryCollection class was identified as the source of a remote code execution (RCE) vulnerability. The analysis of the provided patch commit 2f1ff2f7743680d08da5382ffc8f78be6755e26c from pull request #13505 clearly shows the mitigation. The vulnerability stemmed from the lack of input sanitization on the filter_str argument, which is parsed into an abstract syntax tree (AST) and then compiled into a callable function. An attacker could provide a crafted filter string that, when parsed, would access sensitive attributes of Python objects, such as __globals__, allowing for arbitrary code execution in the context of the application. The patch rectifies this by introducing a blocked_filter_attributes set containing names of dangerous attributes. The _parse_and_validate_filter function was modified to iterate through the AST nodes and explicitly check if any ast.Attribute node attempts to access an attribute present in this blocklist. If such an attempt is detected, a VectorStoreOperationException is raised, effectively preventing the exploit. Therefore, the InMemoryCollection._parse_and_validate_filter function is the precise location of the vulnerability.

Vulnerable functions

InMemoryCollection._parse_and_validate_filter

python/semantic_kernel/connectors/in_memory.py

The function `_parse_and_validate_filter` within the `InMemoryCollection` class is responsible for parsing and validating filter strings. Prior to the patch, this function did not properly sanitize the filter string, allowing for the use of dangerous attributes (e.g., `__globals__`, `__builtins__`). An attacker could craft a malicious filter string to access these attributes, leading to remote code execution. The patch introduces a blocklist of these dangerous attributes and checks for their presence in the parsed abstract syntax tree (AST), thus preventing the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.