Semantic Kernel Search Plugin 的 RCE 漏洞 (AML.CS0062)

一句话通俗理解

提示词注入一路升级成主机 RCE——CVE-2026-26030：AI 层攻击直达系统层。

维度	内容
案例类型	演练 / 安全研究
发生时间	2026-05-07
攻击者	Microsoft Defender Security Research Team
受害目标	Semantic Kernel

微软 Defender 安全研究团队发现 Microsoft Semantic Kernel 的 Search Plugin 存在漏洞（CVE-2026-26030）：攻击者可通过提示词注入操纵插件行为并触发路径遍历，最终实现主机级远程代码执行——证明 AI 框架漏洞可升级为传统系统失陷。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0062 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

LLM 提示词构造 (AML.T0065)

The researchers crafted a prompt designed to instruct the Semantic Kernel agent to call the search tool with attacker-controlled arguments. The argument value was designed to trigger the vulnerable In-Memory Vector Store filter handling and lead to code execution.

AI 产品或服务 (AML.T0047)

The researchers interacted with a Semantic Kernel-based agent via its standard chat interface.

直接提示词注入 (AML.T0051.000)

The researchers submitted the crafted prompt to the agent. The prompt injection caused the model to prepare a search tool invocation using the malicious argument.

AI 智能体工具调用 (AML.T0053)

The Semantic Kernel agent invoked the search tool with the malicious argument designed to escape the filter string.

命令与脚本解释器 (AML.T0050)

The filter was evaluated as a Python lambda expression which served as an injection sink from malicious formatting in the attacker-controlled argument, allowing the researchers’ input to escape the intended comparison logic and achieve remote code execution.

系统失陷 (AML.T0112)

The researchers were able to execute arbitrary code, which would compromise the host machine.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0