Semantic Kernel, Microsoft’s Python SDK, contains a flaw in the InMemoryVectorStore filter function that permits arbitrary code execution. The vulnerability is triggered when malicious input is used to craft a filter, which the store processes and evaluates, leading to execution of attacker-supplied code. The weakness corresponds to code injection as described by CWE-94.

All installations of Microsoft Semantic Kernel Python SDK versions preceding 1.39.4 are affected. The issue exists in the InMemoryVectorStore component of the SDK. Upgrading to version 1.39.4 or later eliminates the problem.

The vulnerability carries a CVSS score of 10, indicating critical severity. EPSS indicates a very low probability of exploitation (< 1%), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to inject malicious filter content that the application accepts, which could be provided by a remote user if filter input is exposed. Once exploited, the attacker gains full code execution privileges within the process hosting Semantic Kernel.