CVE-2026-26030

Description

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.

PUBLISHED Reserved 2026-02-09 | Published 2026-02-19 | Updated 2026-02-26 | Assigner GitHub_M

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

References

github.com/...kernel/security/advisories/GHSA-xjw9-4gw8-4rqx

github.com/microsoft/semantic-kernel/pull/13505

github.com/...oft/semantic-kernel/releases/tag/python-1.39.4

cve.org (CVE-2026-26030)

nvd.nist.gov (CVE-2026-26030)

Download JSON