{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/microsoft-semantic-kernel-prompt-to-rce-2026/",
 "asOf": "2026-09-26",
 "id": "microsoft-semantic-kernel-prompt-to-rce-2026",
 "date": "2026-05-07",
 "datePrecision": "day",
 "title": "Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution",
 "lane": "attack",
 "kind": "vulnerability-disclosure",
 "summary": "Microsoft's Defender security research team described two vulnerabilities in its open-source Semantic Kernel agent framework in which attacker-influenced prompts could reach code execution on the host. One involved unsafe string interpolation in an in-memory vector store filter; the other exposed a code-execution plugin function that allowed arbitrary file writes outside its sandbox. Both were fixed in updated SDK releases.",
 "whyItMatters": "Shows that agent framework plumbing, not just the model, can turn a prompt injection into host compromise.",
 "actors": [
  "microsoft"
 ],
 "topics": [
  "prompt-injection",
  "sandbox-containment",
  "tool-and-mcp-security"
 ],
 "atlas": [
  "tools",
  "sandbox",
  "untrusted-content"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/",
   "publisher": "Microsoft Security",
   "title": "When prompts become shells: RCE vulnerabilities in AI agent frameworks",
   "date": "2026-05-07",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "CVE-2026-26030 affects the Semantic Kernel Python SDK before 1.39.4 (in-memory vector store).",
   "locator": "Vulnerability sections"
  },
  {
   "fact": "CVE-2026-25592 affects the .NET SDK before 1.71.0 (SessionsPythonPlugin), enabling file writes to the host filesystem.",
   "locator": "Vulnerability sections"
  }
 ],
 "significance": 3,
 "fideQuestions": [],
 "methods": [
  "indirect-prompt-injection",
  "memory-poisoning",
  "sandbox-escape",
  "sandboxing-egress"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}