Semantic Kernel exposes an arbitrary file write flaw in its SessionsPythonPlugin before version 1.71.0. When an AI agent calls DownloadFileAsync or UploadFileAsync, the localFilePath parameter can be supplied by the caller, allowing a malicious actor to write data to any path on the host system. This leads to the potential of overwriting configuration files or injecting executable code, compromising confidentiality and integrity of the application.

The affected product is Microsoft's Semantic Kernel .NET SDK, specifically the SessionsPythonPlugin in versions earlier than 1.71.0. The vulnerability is patched in Microsoft.SemanticKernel.Core v1.71.0. No other vendors or products are listed as affected.

The CVSS score of 10 indicates a high severity, but the EPSS value of less than 1% suggests that, as of now, the likelihood of exploitation is low. The vulnerability is not currently recorded in the CISA KEV catalog. Exploitation would require the attacker to supply a prompt or input that triggers the vulnerable agent function calls, so an attacker would need access to the agent invocation context. If achieved, the impact could be serious, potentially enabling code execution or privilege escalation on the target system.