Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-02-20 · source-backed
A critical code injection vulnerability was disclosed in Microsoft's Semantic Kernel Python SDK — the flagship SDK underpinning their agent framework strategy. The InMemoryVectorStore filter allows authenticated attackers with low privileges to execute arbitrary code with no user interaction. Patched in python-1.39.4. This follows the LangChain SSRF CVE from last week, confirming AI framework supply chain security is a recurring critical vulnerability category. What to do: If you're using Semantic Kernel, update to python-1.39.4 immediately. Avoid InMemoryVectorStore in production environments.
Each link below shares sources, entities, or timing with this story.
Microsoft criticizes Semantic Kernel / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft criticizes Semantic Kernel); both cover CVE, CVSS, Microsoft, RCE; overlapping topics (agent, chain, code, framework, microsoft).
Microsoft criticizes Semantic Kernel / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft criticizes Semantic Kernel); both cover CVE, CVSS, Microsoft, RCE; overlapping topics (chain, code).
Agent Framework uses Semantic Kernel / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Agent Framework uses Semantic Kernel); both cover CVE, Microsoft, Semantic Kernel; overlapping topics (agent, allow, arbitrary, framework, microsoft).