NuGet/Microsoft.SemanticKernel.Core CVE-2026-25592: critical 9.9, EPSS 2.52%
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
Action: Upgrade Microsoft.SemanticKernel.Core to 1.71.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.71.0 | - |
Fixed versions
| 1.71.0 |
Sources
- osv: GHSA-2ww3-72rp-wpp4#NuGet/Microsoft.SemanticKernel.Core
- https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4
- https://nvd.nist.gov/vuln/detail/CVE-2026-25592
- https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d
- https://github.com/microsoft/semantic-kernel
- https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64
CVE-2026-25592 · published · modified · JSON