A Prompt Injection Turned Into a Shell: Inside Semantic Kernel's Two RCE CVEs
Two ordinary agent-framework conveniences, a filterable vector search and a file-download tool, turned into remote code execution once an LLM's output was trusted a little too much. Here's what happened in Microsoft Semantic Kernel, and what to check in your own agent code today. Prompt injection usually gets discussed as an output-quality problem: the model says something it shouldn't, or does…
Two common conveniences in Microsoft Semantic Kernel, a filterable vector search and file-download tool, were exploited to achieve remote code execution (RCE) after an LLM's output was trusted too much. Two vulnerabilities, CVE-2026-26030 and CVE-2026-25592, were disclosed by Microsoft in its Semantic Kernel framework, highlighting the risk of prompt injection turning into full RCE.
Both vulnerabilities follow the same underlying pattern, where powerful code-adjacent primitives like eval() and unrestricted file I/O received values traced back to model output, which were treated as attacker-controlled. The lesson from these CVEs is that an LLM's output is attacker-controlled once it has processed untrusted content.
To mitigate such risks, one should audit all methods marked as callable by the model, never eval() or exec() values built from model output, build explicit filters instead of using code-executing shortcuts, validate file paths against an allowlist, and not rely solely on container or sandbox isolation.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
