{"action":"Upgrade Microsoft.SemanticKernel.Core to 1.71.0 or later.","affected":[{"fixed":"1.71.0","introduced":"0"}],"component":"Microsoft.SemanticKernel.Core","cve_ids":["CVE-2026-25592"],"ecosystem":"NuGet","epss":0.02521,"exploited":false,"fixed_versions":["1.71.0"],"ghsa_id":"GHSA-2ww3-72rp-wpp4","id":"tcs_01M5N868W49E7RJZZVZ8P7C95V","modified_at":"2026-06-29T12:26:18.466664657Z","published_at":"2026-02-06T18:37:24Z","references":["https://osv.dev/vulnerability/GHSA-2ww3-72rp-wpp4","https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4","https://nvd.nist.gov/vuln/detail/CVE-2026-25592","https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d","https://github.com/microsoft/semantic-kernel","https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-2ww3-72rp-wpp4#NuGet/Microsoft.SemanticKernel.Core","url":"https://osv.dev/vulnerability/GHSA-2ww3-72rp-wpp4"}],"summary":"Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK"}