CVE-2026-26030

The record

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.

Affected packages

Related vulnerabilities

• GHSA-xjw9-4gw8-4rqx Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote… Same vulnerability
• CVE-2026-25592 Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and… Also affects semantic-kernel
• GHSA-2ww3-72rp-wpp4 Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK Also affects semantic-kernel
• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
• CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
• CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
• CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
• CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94