Urioren

**Name of the Vulnerable Software and Affected Versions** Semantic Kernel Python SDK versions prior to 1.39.4 **Description** A remote code execution issue exists within the `InMemoryVectorStore` filter functionality. **Recommendations** Update to version 1.39.4 or higher. As a temporary workaround, avoid using `InMemoryVectorStore` for production scenarios.

**Name of the Vulnerable Software and Affected Versions** Pydantic AI versions 1.34.0 through 1.50.9 **Description** Pydantic AI contains a path traversal issue in its web UI. A crafted URL can be used by an attacker to serve arbitrary JavaScript within the application's context. This allows execution of attacker-controlled code in the victim's browser, potentially leading to theft of chat history and session cookies. The issue arises because the CDN URL is constructed using a non-validated `version` query parameter from the request URL, enabling path traversal sequences. This vulnerability affects applications utilizing `Agent.to web` or `clai web` to serve a chat interface, which may be running locally or on a remote server. **Recommendations** Upgrade to version 1.51.0 or later to remove the user-controllable `version` parameter and prevent the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Semantic Kernel .NET SDK versions prior to 1.71.0 Agent Framework version 1.0 **Description** An arbitrary file write issue exists in the .NET SDK, specifically within the `SessionsPythonPlugin`. This flaw allows for path traversal, which can be chained with an architectural trust gap in how AI agents handle autonomous tool calls to achieve remote code execution. When `AutoInvokeKernelFunctions` is enabled, the framework may treat stochastic LLM output as high-privilege system commands without effective validation. Attackers can bypass security filters using JSON type confusion, Base64/URL encoding, or Unicode homoglyphs to overwrite application source code, such as `Program.cs`, leading to full host takeover. The issue involves the `DownloadFileAsync()` and `UploadFileAsync()` functions and the `localFilePath` variable. **Recommendations** For Semantic Kernel .NET SDK versions prior to 1.71.0, update to version 1.71.0 or higher. For Agent Framework version 1.0, disable `ToolCallBehavior.AutoInvokeKernelFunctions` and switch to manual function invocation. As a temporary mitigation, create a Function Invocation Filter to verify that the `localFilePath` variable passed to `DownloadFileAsync()` or `UploadFileAsync()` is allow listed. Implement a manual `IFunctionInvocationFilter` to enforce path anchoring to a designated safe root.