Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | semantic-kernel | before 1.71.0 | 1.71.0 | Patch available | CNA |
| — | semantic-kernel (PyPI) | before 1.39.3 | 1.39.3 | Patch available | GHSA-2ww3-72rp-wpp4 |
| — | Microsoft.SemanticKernel.Core (NuGet) | before 1.71.0 | 1.71.0 | Patch available | GHSA-2ww3-72rp-wpp4 |
- semantic-kernel VendorMicrosoft Affected before 1.71.0 Fixed in 1.71.0 Patch available CNA
- semantic-kernel (PyPI) Vendor— Affected before 1.39.3 Fixed in 1.39.3 Patch available GHSA-2ww3-72rp-wpp4
- Microsoft.SemanticKernel.Core (NuGet) Vendor— Affected before 1.71.0 Fixed in 1.71.0 Patch available GHSA-2ww3-72rp-wpp4
Remediation
- Fix · CNA semantic-kernel (microsoft) Fixed in 1.71.0
- Fix · GHSA-2ww3-72rp-wpp4 semantic-kernel (PyPI) Fixed in 1.39.3 Advisory →
- Fix · GHSA-2ww3-72rp-wpp4 Microsoft.SemanticKernel.Core (NuGet) Fixed in 1.71.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25592
- 2026-10-03 Alias added: GHSA-2ww3-72rp-wpp4
References
Other 4
- https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4
- https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d
- https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64
- https://github.com/microsoft/semantic-kernel
More Microsoft vulnerabilities
- TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-25592 · CVE Program
- CVE-2026-25592 · NVD
- FIRST EPSS
- GHSA-2ww3-72rp-wpp4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences