Case · DiggingBeagle record
CVE-2026-26030 allowed a model-controlled Search Plugin parameter to reach an unsafe eval-based filter path and execute code on the Semantic Kernel host under affected conditions.
Semantic Kernel Python versions before 1.39.4 when an agent exposes the Search Plugin backed by the vulnerable In-Memory Vector Store filter functionality and an attacker can influence the agent input.
Microsoft's demonstration used a hotel-finder agent. The model selected a search tool and supplied a city parameter. In the affected implementation, that parameter was interpolated into a Python lambda expression that was later executed with eval().
The framework had an AST validator, so exploitation was not simply a direct call to eval with arbitrary text. Microsoft showed a payload that remained valid under the implemented checks while traversing Python classes to reach an importer and eventually os.system. The result was host-level command execution.
This is a useful example of why a prompt-injection finding and a tool vulnerability must be reconstructed together. The model supplied the data, but the deterministic framework code created the execution sink.
The attacker influences the model's natural-language input.
Boundary: untrusted content / model
The model calls the Search Plugin with an attacker-influenced city value.
Boundary: model output / tool schema
The vulnerable filter interpolates the value into a Python lambda expression.
Boundary: tool parameter / code generation
The crafted value survives validation and reaches dynamic execution.
Boundary: validator / Python eval
The agent host runs attacker-controlled code.
Boundary: agent framework / operating system
The advisory identifies the patched Semantic Kernel Python version.
Microsoft documents the prompt-to-RCE chain and defensive guidance.
Locator: CVE-2026-26030 section
Microsoft lists prompt injection and the default Search Plugin configuration as the two required conditions.
Locator: Exploit and validator analysis
The disclosed payload reached BuiltinImporter and os.system while passing the implemented structural checks.
Locator: Affected versions and patched versions
GitHub lists versions below 1.39.4 as affected and 1.39.4 as patched.
Locator: Unsafe string interpolation
Microsoft shows the city parameter entering a lambda expression that is later evaluated.
diagram
Attacker influences agent input
Search Plugin receives attacker-influenced city value
Value interpolated into Python lambda
Crafted expression survives implemented checks
Dynamic expression is executed
Shell command runs on host
Treat model-controlled tool parameters as attacker-controlled input. Patch the framework, remove unsafe dynamic evaluation paths, and investigate the vulnerable deployment window for host-level indicators rather than assuming a model refusal would have prevented exploitation.
DiggingBeagle. “Semantic Kernel prompt injection reached host code execution.” First seen Feb 19, 2026. https://diggingbeagle.com/cases/semantic-kernel-prompt-injection-reached-host-code-execution/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.