PyPI/semantic-kernel CVE-2026-26030: critical 9.9, EPSS 3.91%

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

Action: Upgrade semantic-kernel to 1.39.4 or later.

pip install semantic-kernel==1.39.4

Affected

Fixed versions

Sources

• osv: GHSA-xjw9-4gw8-4rqx
• https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-xjw9-4gw8-4rqx
• https://nvd.nist.gov/vuln/detail/CVE-2026-26030
• https://github.com/microsoft/semantic-kernel/pull/13505
• https://github.com/microsoft/semantic-kernel
• https://github.com/microsoft/semantic-kernel/releases/tag/python-1.39.4
• https://github.com/pypa/advisory-database/tree/main/vulns/semantic-kernel/PYSEC-2026-163.yaml

CVE-2026-26030 · published 2026-02-19T19:34:14Z · modified 2026-06-08T23:30:20.861750576Z · JSON