Microsoft Semantic Kernel Python SDK Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Microsoft Semantic Kernel Python SDK, specifically in versions prior to 1.39.4. The issue arises within the 'InMemoryVectorStore' filter functionality, allowing for unauthorized code execution. Users are advised to upgrade to version 1.39.4 or later. As a temporary measure, 'InMemoryVectorStore' should be avoided in production environments.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable Semantic Kernel SDK is used.

Remediation

Users should upgrade to Microsoft Semantic Kernel Python SDK version 1.39.4 or later. The updated version is available on the GitHub Releases page for the Semantic Kernel repository.