microsoft/semantic-kernel · error · VectorStoreOperationException

Call target node type '{type(node.func).name}' is not al

Error message

Call target node type '{type(node.func).__name__}' is not allowed in filter expressions. Only direct function and method calls are supported.

What it means

Thrown by InMemoryCollection._parse_and_validate_filter (in_memory.py:803) when an ast.Call node's target (.func) is neither ast.Name nor ast.Attribute. The sandbox only supports direct function calls (name(...)) and direct method calls (obj.method(...)); indirect calls like calling a subscripted or parenthesized expression are blocked to prevent dynamic dispatch out of the sandbox.

Source

Thrown at python/semantic_kernel/connectors/in_memory.py:803

                    "This attribute could be used to escape the filter sandbox."
                )

            # For Name nodes, only allow the lambda parameter
            if isinstance(node, ast.Name) and node.id not in lambda_param_names:
                raise VectorStoreOperationException(
                    f"Use of name '{node.id}' is not allowed in filter expressions. "
                    f"Only the lambda parameter(s) ({', '.join(lambda_param_names)}) can be used."
                )

            # For Call nodes, validate that only allowed functions are called
            if isinstance(node, ast.Call):
                func_name: str
                if isinstance(node.func, ast.Name):
                    func_name = node.func.id
                elif isinstance(node.func, ast.Attribute):
                    func_name = node.func.attr
                else:
                    raise VectorStoreOperationException(
                        f"Call target node type '{type(node.func).__name__}' is not allowed in filter expressions. "
                        "Only direct function and method calls are supported."
                    )

                if func_name not in self.allowed_filter_functions:
                    raise VectorStoreOperationException(
                        f"Function '{func_name}' is not allowed in filter expressions. "
                        f"Allowed functions: {', '.join(sorted(self.allowed_filter_functions))}"
                    )

            if (
                isinstance(node, (ast.List, ast.Tuple, ast.Set))
                and len(node.elts) > self.max_filter_literal_collection_size
            ):
                raise VectorStoreOperationException(
                    "Collection literals in filter expressions exceed the maximum allowed size."
                )

View on GitHub (pinned to c028a0c7dc)

Solutions

Rewrite the call as a direct method call: "lambda x: x.get('a')" instead of "(x.get)('a')".
Replace indirect dispatch with one of the allowed direct function/method names (len, str, get, contains, etc.).
If the logic cannot be expressed as a direct call, move that logic out of the string filter and pass a Python callable in options.filter.
Audit untrusted filter input: this error often indicates an attempt to bypass the sandbox.

Example fix

# before
filter = "lambda x: (x.get)('status') == 'ok'"

# after
filter = "lambda x: x.get('status') == 'ok'

Defensive patterns

Strategy: validation

Validate before calling

import ast

def uses_only_direct_calls(filter_str: str) -> bool:
    tree = ast.parse(filter_str, mode="eval")
    for node in ast.walk(tree):
        if isinstance(node, ast.Call) and not isinstance(node.func, (ast.Name, ast.Attribute)):
            return False
    return True

Type guard

def is_direct_call_filter(filter_str: str) -> bool:
    try:
        tree = ast.parse(filter_str, mode="eval")
    except SyntaxError:
        return False
    return all(
        not (isinstance(n, ast.Call) and not isinstance(n.func, (ast.Name, ast.Attribute)))
        for n in ast.walk(tree)
    )

Try / catch

from semantic_kernel.exceptions.vector_store_exceptions import VectorStoreOperationException

try:
    opts = VectorSearchOptions(filter=filter_str)
except VectorStoreOperationException as ex:
    if "Call target node type" in str(ex):
        filter_str = rewrite_to_direct_call(filter_str)

Prevention

Write calls as direct name(...) or obj.method(...) only; never parenthesize or subscript the callable before calling.
Do not attempt higher-order functions inside string filters.
Treat an indirect-call attempt in untrusted input as a likely sandbox-escape probe.
Pass a Python callable when the logic needs richer dispatch.

When it happens

Trigger: A string filter whose call target is computed, e.g. "lambda x: (x.get)('a')", "lambda x: x['f'](1)", or "lambda x: (lambda y: y)(x)". Anything where node.func is not a Name or Attribute trips in_memory.py:802-806.

Common situations: Trying to alias a method then call it; wrapping callables in parentheses; attempting higher-order or lambda-returning expressions inside the filter string; obfuscated input that an attacker hopes will evade the function-name allowlist.

Related errors

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/c2813a765889f86c. Report an issue: GitHub.