title: Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)
id: ATR-2026-00440
rule_version: 2
status: experimental
description: |
  Detects exploitation of CVE-2026-26030 (Critical), remote code execution in Microsoft Semantic Kernel via unsafe string interpolation in In-Memory Vector Store filter functions. The vulnerable sink interpolates a user/LLM-controlled filter expression and evaluates it as a lambda; attacker constructs a lambda body that traverses Python's class hierarchy via `tuple()` to reach `BuiltinImporter` and execute `os.system()`, achieving unauthenticated RCE on the Semantic Kernel host. This rule detects the LLM-output / user-input payload patterns that reach the filter sink: lambda definitions combined with eval / __import__ / AST-traversal-via-mro patterns inside content or user_input fields a Semantic Kernel agent is likely to interpolate. CWE-94, CWE-95. Patches available in Python semantic-kernel >= 1.39.4 and .NET semantic-kernel >= 1.71.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch.
author: ATR Community
date: 2026/05/11
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0051 - LLM Prompt Injection
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1059.006 - Python
  cve:
    - CVE-2026-26030
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-26030 lets unfiltered LLM output drive lambda/eval interpolation in Semantic Kernel's vector-store filter; Article 15 cybersecurity requirements mandate that high-risk AI systems neutralise interpreter sinks reachable from model or user input.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate lambda-with-eval and AST-traversal payloads from LLM output as a high-risk vector — particularly in vector-store filter paths, which are typically considered low-risk infrastructure.
      strength: primary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)) would bypass or undermine that oversight.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Adversarial inputs that drive an LLM to emit lambda bodies invoking eval / __import__ / mro-traversal must be tracked as a primary input-attack class affecting framework-level integrations.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans under MG.2.3 must require static and runtime detection of dynamic-evaluation primitives in any code path that consumes LLM output, including filter / search / ranking sinks.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must prohibit dynamic-evaluation primitives (eval, exec, lambda-with-eval, Function constructor) being reached by any LLM-generated or user-supplied content path.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the agent-manipulation technique (Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030)) is such a treatment.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: framework-eval-rce
  scan_target: both
  confidence: high
agent_source:
  type: llm_io
  framework:
    - semantic-kernel
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate Python educational content discussing lambda safety or eval() risks.
    - Static analysis tooling output documenting CVE-2026-26030 attack patterns for defensive purposes.
    - Patched Semantic Kernel filter expressions that use AST allowlisting and reject lambda bodies before evaluation.
  conditions:
    - field: content
      operator: regex
      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\beval\s*\(
      description: 'Lambda body invoking eval() — primary CVE-2026-26030 exploit shape (`lambda row: eval(filter_expr)`)'
    - field: content
      operator: regex
      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b__import__\s*\(\s*["\x27](?:os|subprocess|socket|builtins|importlib)["\x27]
      description: Lambda body using __import__ to reach OS / process / builtin modules — eval-friendly RCE chain
    - field: content
      operator: regex
      value: (?i)\(\s*\)\.__class__\.__mro__|tuple\s*\(\s*\)\.__class__|\(\s*\)\.__class__\.__bases__|__subclasses__\s*\(\s*\)
      description: Python class-hierarchy traversal primitives (tuple().__class__.__mro__, __subclasses__()) — AST-bypass building block used to reach BuiltinImporter
    - field: content
      operator: regex
      value: (?i)BuiltinImporter|\btypes\.FunctionType\b|\bFunctionType\s*\(|getattr\s*\(\s*(?:object|type|__builtins__)\b
      description: 'BuiltinImporter, Python types.FunctionType reflective construction, or reflective getattr on built-in roots — excludes bare ''FunctionType'' which collides with TypeScript terminology. The root name must end at a word boundary: without it ''getattr(types.Scale, name)'' read as getattr on the built-in type'
    - field: content
      operator: regex
      value: (?i)\bFunction\s*\(\s*["\x27].{0,200}?(?:return\s+(?:eval|new\s+Function|require|process)|os\.system|child_process)["\x27]
      description: .NET / JavaScript Function() constructor with body invoking eval / process — cross-runtime variant
    - field: user_input
      operator: regex
      value: (?i)lambda\s+(?:\w+\s*)?:[^,)]*\b(?:eval|exec|__import__)\s*\(
      description: User-supplied filter expression containing lambda + dynamic-evaluation primitive — the original CVE-2026-26030 injection surface
response:
  actions:
    - block_input
    - alert
    - escalate
  notify:
    - security_team
remediation: |
  Upgrade Python semantic-kernel to >= 1.39.4 or .NET semantic-kernel to >= 1.71.0. Reject filter expressions containing lambda bodies via AST allowlisting before evaluation. Never pass LLM-generated content to any dynamic-evaluation primitive (eval, exec, lambda-with-eval, Function constructor) regardless of perceived sanitisation. Treat LLM output as untrusted input from a security perspective.