Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
Impact
What kind of vulnerability is it? Who is impacted?
An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin.
Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and are using the SessionsPythonPlugin
Patches
Has the problem been patched? What versions should users upgrade to? The problem has been fixed in Microsoft.SemanticKernel.Plugins.Core version 1.71.0. Users should upgrade to version 1.71.0 or higher.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed.
References
Are there any links users can visit to find out more?
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Microsoft.SemanticKernel.Core | < 1.71.0 | 1.71.0 |
| Python (PyPI) | semantic-kernel | < 1.39.3 | 1.39.3 |
References
- https://github.com/microsoft/semantic-kernel/security/advisories/GHSA-2ww3-72rp-wpp4
- https://nvd.nist.gov/vuln/detail/CVE-2026-25592
- https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d
- https://github.com/microsoft/semantic-kernel
- https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64
- https://pypi.org/project/semantic-kernel
- https://github.com/advisories/GHSA-2ww3-72rp-wpp4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-22- Platform
- .NET (NuGet), Python (PyPI)
- Package
Microsoft.SemanticKernel.Core, semantic-kernel- Disclosed
- 06.02.2026
- Updated
- 11.10.2026 13:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2ww3-72rp-wpp4 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-531 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: semantic-kernel
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 02.2026 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
Disclosures per year
- 2026: 2
-
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.