Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Critical9.9CVE-2026-26030 · Published Feb 19, 2026 · updated Jun 8, 2026
### Impact: An RCE vulnerability has been identified in Microsoft Semantic Kernel Python SDK, specifically within the `InMemoryVectorStore` filter functionality. ### Patches: The problem has been fixed in [python-1.39.4](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4). Users should upgrade this version or higher. ### Workarounds: Avoid using `InMemoryVectorStore` for production scenarios. ### References: [Release python-1.39.4 · microsoft/semantic-kernel · GitHub](https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4) [PR to block use of dangerous attribute names that must not be accessed in filter expressions](https://github.com/microsoft/semantic-kernel/pull/13505)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| semantic-kernel PyPI | < 1.39.4 | 1.39.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2026-26030, PYSEC-2026-163
- github.com/microsoft/semantic-kernel/security/advisories/GHSA-xjw9-4gw8-4rqx
- nvd.nist.gov/vuln/detail/CVE-2026-26030
- github.com/microsoft/semantic-kernel/pull/13505
- github.com/microsoft/semantic-kernel
- github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4
- github.com/pypa/advisory-database/tree/main/vulns/semantic-kernel/PYSEC-2026-163.yaml
More Semantic Kernel advisories
All Semantic Kernel| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 6 | Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK Critical9.9Feb 6 | Critical9.9 | 1.39.3 |