2026-05-07 · 2026-Q2
Microsoft Semantic Kernel Prompt-Injection to RCE (CVE-2026-26030, CVE-2026-25592)
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Microsoft Semantic Kernel agent framework, Python before 1.39.4 and .NET SDK before 1.71.0
Impact
Prompt injection escalates to host-level remote code execution and sandbox escape; Microsoft demonstrated launching calc.exe from a single prompt, plus arbitrary file write and data exfiltration
Root cause
CVE-2026-26030 (Python) is unsafe string interpolation of AI-model-controlled parameters in the in-memory vector store with a blocklist bypassable through Python class-hierarchy traversal; CVE-2026-25592 (.NET) exposed `DownloadFileAsync` to model invocation because it was accidentally marked `[KernelFunction]` with no path validation
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Microsoft Semantic Kernel Prompt-Injection to RCE (CVE-2026-26030, CVE-2026-25592) (2026-05-07). https://agentprov.com/incidents/2026-05-07-microsoft-semantic-kernel-prompt-injection-to-rce-cve-2026-26030-cve-2026-25592
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config