CVE-2026-26030 and CVE-2026-25592 dropped on Microsoft Semantic Kernel on 7 May 2026. A confirmed template-interpolation RCE in a production agent framework. That is the seed primitive — not the product. The product is the systematic map of every framework's template-substitution layer against eight reusable RCE primitives across six injection surfaces.
Nine framework adapters. Eight primitives. Six surfaces. 72 cells. Each cell is one of RCE confirmed, sandbox blocked, or not applicable. The matrix is the defensive-posture map: KPMG and Gartner buy this, not the one-CVE exploit.
Confirmation is never inferred. Every RCE finding rests on a literal Path.read_bytes() == expected canary check on the host filesystem. Every confirmation is signed Ed25519 and round-trips into CAMPAIGN GRAPH for cross-tool composition.
Microsoft Semantic Kernel — CVE-2026-26030 & CVE-2026-25592 (7 May 2026). Template-interpolation RCE via Jinja2-style argument substitution. Patched in Semantic Kernel 1.40+. Confirmed seed primitive for SHELL's ast_attribute_traversal family. SHELL generalises the class across the agent-framework ecosystem.
TEMPLATE-RCE
SANDBOX-BYPASS
PICKLE-RCE
CALLBACK-IMPORT
YAML-LOAD
Coverage
72-CELL DEFENSIVE POSTURE MATRIX
Live results from one build-host run (May 2026). RCE cells were confirmed by canary file-on-disk verification. sandbox cells were rendered and rejected by the framework's sandbox layer. N/A cells are genuinely unreachable: the framework does not expose a surface the primitive can target. The distinction matters — N/A is fundamentally different from sandbox-blocked.
Framework
RCE
Sandbox blocked
N/A
Verdict
LangChain
0
4
4
Jinja2 SandboxedEnvironment doing its job
LangGraph
1
4
3
Pickle checkpoint store live (CVE-2025-67644 class)
LlamaIndex
0
4
4
Jinja2 sandbox enforced
Haystack
0
4
4
Jinja2 sandbox enforced
DSPy
2
0
6
Python f-strings; tool-registration import live
PydanticAI
2
0
6
Tool-decorator import path live
LiteLLM
3
5
0
YAML unsafe-load + callback registration live
SemanticKernel
0
4
4
CVE-2026-26030 patched; sandbox holds
Strands
2
0
6
Tool-registry import path live
TOTAL
10
25
37
72 cells
Architecture
8 SUBSYSTEMS
SUBSYSTEM 01
SURVEY
OBSERVE
Framework + version + sandbox fingerprinting across the nine adapters. Detects Jinja2 sandbox mode, pickle store presence, custom template engines, and adapter availability via real package metadata.
SUBSYSTEM 02
LATTICE
OBSERVE
Surface enumeration: 9 frameworks × 6 surfaces = up to 54 candidate slots. Classifies each as injectable, sandbox-bound, or not-exposed. Audit-only — no payload delivered.
SUBSYSTEM 03
TRAVERSE
FORGE / INJECT
Primitive delivery via the adapter render path. FORGE tier dry-runs (payload emitted, not delivered). INJECT tier delivers live and confirms via canary file-on-disk check. Produces the 72-cell coverage matrix.
SUBSYSTEM 04
SANDBOX
OBSERVE
Runtime container detection: E2B, Modal, Daytona, Docker, lxc, bare-metal. Informs the operator whether confirmed RCE escapes the agent's sandbox or is contained inside it.
SUBSYSTEM 05
STARTUP
INJECT
YAML unsafe-load + .env shell-expansion config injection. Targets the configuration boundary — agents that load operator-provided config files at startup. Real PyYAML default-loader gadget chain.
Post-RCE persistence artefacts: shell rc / cron / systemd-user unit / jupyter kernel.json. Writes only into an operator-review quarantine directory — never installs to a live persistence location. DESTROY-gated.
SUBSYSTEM 08
EVIDENCE
OPEN
Canonical NIGHTFALL JSON. Ed25519-signed envelope. Auto-commits to CAMPAIGN GRAPH for cross-tool composition. SHL-{hex12} report id. Every confirmed-RCE finding emits a suggested edge into the propagation DAG.
Primitives
8 RCE PRIMITIVES
Each primitive is tested live against a real framework or runtime. Canary verification is byte-for-byte on the host filesystem.
Each adapter routes primitive payloads through the framework's real public API. Frameworks not installed on the host raise FrameworkNotInstalled and tests skip cleanly — never simulated.
CORE FRAMEWORKS
LANGCHAIN
PromptTemplate Jinja2 SandboxedEnv 5 surfaces
LANGGRAPH
checkpoint store Pickle surface live CVE-2025-67644 class
LLAMAINDEX
RichPromptTemplate Jinja2 sandboxed 4 surfaces
HAYSTACK
PromptBuilder Jinja2 sandboxed 4 surfaces
SEMANTIC KERNEL
Jinja2PromptTemplate CVE-2026-26030 target Patched in 1.40+
AGENT / TOOL FRAMEWORKS
DSPY
Python f-strings tool descriptor import 2 RCE cells live
PYDANTIC AI
@agent.tool decorator import-time RCE 2 RCE cells live
tool registry import module body executes 2 RCE cells live
Bedrock Agents and Vertex Agent Builder are v1.1 candidates — they need AWS / GCP credentials this host's test environment does not carry. Adding a 10th adapter is roughly 200 LOC plus 5 tests.
Surfaces
6 INJECTION SURFACES
SYSTEM_PROMPT
TOOL_DESCRIPTOR
RAG_RETRIEVAL
CONVERSATION_MEMORY
MCP_TOOL_RESULT
CONFIG_ENV_INTERPOLATION
Every (framework × surface × primitive) tuple is one cell. SHELL's coverage classifier distinguishes RCE from sandbox_blocked from not_applicable. The latter is a positive defensive-posture signal: the framework does not expose the surface for the primitive to land on — no patch required, no mitigation owed.
Usage
SPECTER-SHELL CLI
# Generate operator keys (Ed25519, PKCS8 PEM) $ specter-shell keygen --out ./keys keypair written to ./keys/specter_shell_priv.pem (mode 0600)
OBSERVE: SURVEY, LATTICE, SANDBOX, EVIDENCE read-only. No payload emitted, no key required.
FORGE: TRAVERSE dry-run. Payload bytes computed and recorded, not delivered. Requires Ed25519 operator key on PATH.
INJECT: TRAVERSE live, STARTUP, LITELLM. Payload reaches the framework's render path; canary verification on disk. Requires Ed25519 operator key plus a signed override token over the engagement scope artefact.
DESTROY: PERSIST. Writes shell rc / cron / systemd-user / jupyter kernel.json artefacts into an operator-review quarantine directory — never installed to live persistence locations. Requires the Ed25519 key, override signature, and an explicit confirmation flag.
Generate a keypair: specter-shell keygen --out ./keys
Intelligence
MITRE ATLAS / OWASP LLM MAPPING
AML.T0051
LLM Prompt Injection — TRAVERSE surface delivery
AML.T0011
Command and Scripting Interpreter — os.system reach