CriticalVulnerability
GHSA-xjw9-4gw8-4rqx: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
- Identifiers
- CVE-2026-26030GHSA-xjw9-4gw8-4rqx
- Published
- Record updated
- Affected
- semantic-kernel < 1.39.4
- Fixed in
- 1.39.4
- released February 10, 2026, 9 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 3.9%
Summary
Microsoft Semantic Kernel Python SDK contains a remote code execution vulnerability in the InMemoryVectorStore filter functionality. The issue is tracked as GHSA-xjw9-4gw8-4rqx.
Mitigation
Fixed in python-1.39.4. Users should upgrade to this version or higher. Workaround: avoid using InMemoryVectorStore for production scenarios.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- semantic-kernelPyPILLM dependency since 2023-04-11 · 3 tracked dependents
Coverage
News, research and other items that mention CVE-2026-26030.
- GenAI and Agentic AI Exploit Roundup Q2 2026OWASP GenAI Security · 2026-07-09
Related items
- HighCVE-2026-108456 Azure AI Foundry Elevation of Privilege VulnerabilitySame vendor · MSRC Security Update Guide
- HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
- LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database