When prompts become shells: RCE vulnerabilities in AI agent frameworks

The provided information details two vulnerabilities in Microsoft's Semantic Kernel framework, which is designed for building AI-powered applications. Both vulnerabilities allow an attacker to execute arbitrary code with elevated privileges on a target system through carefully crafted prompts.

Vulnerability Overview

CVE-2026-25592: Arbitrary File Write Through SessionsPythonPlugin

Description: This vulnerability allows attackers to bypass the sandboxing mechanism provided by Azure Container Apps and write files directly to the host device's filesystem, leading to full remote code execution (RCE).

Mechanism:

1. Sandbox Isolation Breach: The built-in plugin SessionsPythonPlugin is designed to execute Python code within isolated sandboxes in Azure Container Apps.
2. File Transfer Functions: The plugin includes functions like UploadFile and DownloadFile, which are intended for transferring files between the sandbox and the host system.
3. Exploitation:
   • An attacker can exploit this by crafting a prompt that manipulates these file transfer functions to write arbitrary files to sensitive directories on the host, such as the Windows Startup folder.

CVE-2026-26030: Arbitrary Code Execution Through `In-Memory

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.