Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

CVE-2026-26030 · Published Feb 19, 2026 · updated Jun 8, 2026

Critical9.9

Fix: upgrade to 1.39.4 or later

Impact:

An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the InMemoryVectorStore filter functionality.

Patches:

The problem has been fixed in [python-1.39.4](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4). Users should upgrade this version or higher.

Workarounds:

Avoid using InMemoryVectorStore for production scenarios.

References:

[Release python-1.39.4 · microsoft/semantic-kernel · GitHub](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4)

[PR to block use of dangerous attribute names that must not be accessed in filter expressions](https://github.com/microsoft/semantic-kernel/pull/13505)

Affected versions

Package	Affected	Fixed in
semantic-kernel PyPI	< 1.39.4	1.39.4

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-94
Also known as: CVE-2026-26030, PYSEC-2026-163

More Semantic Kernel advisories

All Semantic Kernel

Critical 9.9Feb 6

Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDKCVE-2026-25592fixed in 1.39.3