Microsoft Semantic Kernel (Python) runs InMemoryVectorStore filter conditions as code

Who is affected

Check your version with pip show semantic-kernel, then search your code for InMemoryVectorStore or InMemoryCollection.

How it works

Semantic Kernel lets developers wrap features like “search the data” as plugins and hand them to an AI model, which decides on its own when to call them and with what parameters. The problem lies in how the InMemory vector database handles “filter conditions.”

Older versions assembled the filter condition into a string of Python code (a lambda function) and then had Python run it. When the model filled in the plugin’s parameters, the text it produced was spliced right into that code.

The flawed approach (conceptual illustration, not the original source code):

# Parameters chosen by the model are spliced directly into a code string
expr = f"lambda record: record.category == '{model_argument}'"
filter_fn = eval(expr)   # the string becomes real code

The developers did put up defenses: older versions first parsed the string into a syntax tree, allowed only a lambda, and blocked dangerous names such as eval, exec, and open. But Microsoft’s research article points out that in a highly dynamic language like Python, a blocklist is “inherently fragile”: by digging through an object’s internal attributes layer by layer, you can reach dangerous functionality without ever writing a blocked name. From 1.39.2, the check switched to an allowlist (only specific syntax nodes and function calls), but it did not limit attribute names, so every version before 1.39.4 is still affected.

This is CWE-94 (improper control of generation of code): a filter value that should only ever be “data” becomes “code.” And the one feeding in that data is an AI model, which can itself be manipulated by prompt injection, so the whole chain becomes “a piece of text → the server runs code.”

An alternative design (a conceptual illustration for your own application, not the actual 1.39.4 fix):

# Represent the filter condition as structured data, with no eval involved
filter_spec = {"field": "category", "op": "eq", "value": model_argument}
results = [r for r in records if getattr(r, filter_spec["field"]) == filter_spec["value"]]

Note that the semantic-kernel library itself still runs the filter string with a restricted eval in 1.39.4; it did not switch to the approach above. The 1.39.4 fix keeps the existing syntax tree check (only specific node types and function calls are allowed) and adds a block on 44 dangerous internal attribute names. For your own code, the more fundamental rule is: don’t let model output become executable code.

Timeline

Further reading

• The same Microsoft research also disclosed CVE-2026-25592: a file download feature that the AI can call, which lets the sandbox write files to the host.
• Related weakness types: CWE-94 improper control of generation of code, prompt injection (LLM01 in the OWASP LLM Top 10).
• Scoring differences: GitHub / NVD rate it CVSS 9.9 Critical; MSRC rates it Important with CWE-749. This page uses the scores from the CNA (GitHub) and NVD.