Search
Find a vulnerability
Search criteria
22 vulnerabilities found for kiota by microsoft
CVE-2026-73851 (GCVE-0-2026-73851)
Vulnerability from nvd – Published: 2026-08-17 15:11 – Updated: 2026-08-17 15:26
VLAI
EPSS
VEX
Title
Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:26 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/issues/7912 | x_refsource_MISC |
| https://github.com/microsoft/kiota/pull/7910 | x_refsource_MISC |
| https://github.com/microsoft/kiota/pull/7913 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/430008e… | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/de3d18d… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.29.1 | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.34.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:26:24.544956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:26:40.140Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.34.0"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:11:39.724Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"
},
{
"name": "https://github.com/microsoft/kiota/issues/7912",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/issues/7912"
},
{
"name": "https://github.com/microsoft/kiota/pull/7910",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7910"
},
{
"name": "https://github.com/microsoft/kiota/pull/7913",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7913"
},
{
"name": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"
},
{
"name": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.29.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.34.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"
}
],
"source": {
"advisory": "GHSA-p5rm-jg5c-8c77",
"discovery": "UNKNOWN"
},
"title": "Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73851",
"datePublished": "2026-08-17T15:11:39.724Z",
"dateReserved": "2026-08-13T17:44:28.644Z",
"dateUpdated": "2026-08-17T15:26:40.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59867 (GCVE-0-2026-59867)
Vulnerability from nvd – Published: 2026-07-16 14:48 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 15:35 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7888 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/cccd798… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T15:35:45.668795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T15:37:02.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:35.538Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8"
},
{
"name": "https://github.com/microsoft/kiota/pull/7888",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7888"
},
{
"name": "https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-rg4h-fpcp-2qm8",
"discovery": "UNKNOWN"
},
"title": "Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59867",
"datePublished": "2026-07-16T14:48:11.958Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:35.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59866 (GCVE-0-2026-59866)
Vulnerability from nvd – Published: 2026-07-16 14:46 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7884 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/dc812db… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:40.596267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:26:17.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:20.823Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6"
},
{
"name": "https://github.com/microsoft/kiota/pull/7884",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7884"
},
{
"name": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4vv7-jj25-4gh6",
"discovery": "UNKNOWN"
},
"title": "Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59866",
"datePublished": "2026-07-16T14:46:50.738Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:20.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59865 (GCVE-0-2026-59865)
Vulnerability from nvd – Published: 2026-07-16 14:43 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7883 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/e1d6d76… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:38.534893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:26:17.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.\u003clanguage\u003e.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota\u0027s recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension\u0027s kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:03.236Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj"
},
{
"name": "https://github.com/microsoft/kiota/pull/7883",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7883"
},
{
"name": "https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-hq9q-27g5-qwpj",
"discovery": "UNKNOWN"
},
"title": "Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59865",
"datePublished": "2026-07-16T14:43:40.058Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:03.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59864 (GCVE-0-2026-59864)
Vulnerability from nvd – Published: 2026-07-16 14:45 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 00:00 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7892 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/9a18599… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T03:56:38.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:52.269Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4jwf-m4wg-8p66",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4jwf-m4wg-8p66"
},
{
"name": "https://github.com/microsoft/kiota/pull/7892",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7892"
},
{
"name": "https://github.com/microsoft/kiota/commit/9a185994a4e549b7bba3cc2beffb9736aa902e79",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/9a185994a4e549b7bba3cc2beffb9736aa902e79"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4jwf-m4wg-8p66",
"discovery": "UNKNOWN"
},
"title": "Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59864",
"datePublished": "2026-07-16T14:45:36.247Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:02:52.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59863 (GCVE-0-2026-59863)
Vulnerability from nvd – Published: 2026-07-16 14:42 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 15:22 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7885 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/4049327… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T15:22:52.387399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T15:33:19.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\\\ or // paths, Windows drive X:\\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:40.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m"
},
{
"name": "https://github.com/microsoft/kiota/pull/7885",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7885"
},
{
"name": "https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4rj6-vrwv-wr8m",
"discovery": "UNKNOWN"
},
"title": "Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59863",
"datePublished": "2026-07-16T14:42:02.337Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:02:40.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59862 (GCVE-0-2026-59862)
Vulnerability from nvd – Published: 2026-07-16 14:38 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in the Python Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/releases/tag/v1.32.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:36.677843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:43.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota\u0027s Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:15.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0"
}
],
"source": {
"advisory": "GHSA-7f3j-j7jj-r3vr",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in the Python Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59862",
"datePublished": "2026-07-16T14:38:59.471Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:15.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59861 (GCVE-0-2026-59861)
Vulnerability from nvd – Published: 2026-07-16 14:36 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7746 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/fee1b64… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:35.781411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:44.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota\u0027s Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:02.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw"
},
{
"name": "https://github.com/microsoft/kiota/pull/7746",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7746"
},
{
"name": "https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0"
}
],
"source": {
"advisory": "GHSA-xg2h-5xr2-29jw",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in Kiota Ruby Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59861",
"datePublished": "2026-07-16T14:36:32.010Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:02.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59860 (GCVE-0-2026-59860)
Vulnerability from nvd – Published: 2026-07-16 14:34 – Updated: 2026-08-17 15:01
VLAI
EPSS
VEX
Title
Kiota: XML Doc-Comment Newline Breakout Code Injection
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7831 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/ebb632d… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.3 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:34.813340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:44.335Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// \u2026 comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:01:37.307Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"
},
{
"name": "https://github.com/microsoft/kiota/pull/7831",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7831"
},
{
"name": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.3"
}
],
"source": {
"advisory": "GHSA-3hrf-2gc2-mx32",
"discovery": "UNKNOWN"
},
"title": "Kiota: XML Doc-Comment Newline Breakout Code Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59860",
"datePublished": "2026-07-16T14:34:24.549Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:01:37.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59859 (GCVE-0-2026-59859)
Vulnerability from nvd – Published: 2026-07-16 14:40 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in the PHP Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7863 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/5e2a211… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:37.664979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:29:05.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota\u0027s PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj-\u003eprop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:29.204Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j"
},
{
"name": "https://github.com/microsoft/kiota/pull/7863",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7863"
},
{
"name": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4"
}
],
"source": {
"advisory": "GHSA-jqwh-526h-c92j",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in the PHP Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59859",
"datePublished": "2026-07-16T14:40:27.319Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:29.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41134 (GCVE-0-2026-41134)
Vulnerability from nvd – Published: 2026-04-22 20:20 – Updated: 2026-08-17 15:01
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection
Summary
Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-25 03:55 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-25T03:55:47.201212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-27T13:35:02.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:01:15.166Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-2hx3-vp6r-mg3f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-2hx3-vp6r-mg3f"
}
],
"source": {
"advisory": "GHSA-2hx3-vp6r-mg3f",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-41134",
"datePublished": "2026-04-22T20:20:57.541Z",
"dateReserved": "2026-04-17T12:59:15.738Z",
"dateUpdated": "2026-08-17T15:01:15.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73851 (GCVE-0-2026-73851)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:11 – Updated: 2026-08-17 15:26
VLAI
EPSS
VEX
Title
Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:26 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/issues/7912 | x_refsource_MISC |
| https://github.com/microsoft/kiota/pull/7910 | x_refsource_MISC |
| https://github.com/microsoft/kiota/pull/7913 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/430008e… | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/de3d18d… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.29.1 | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.34.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:26:24.544956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:26:40.140Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.34.0"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:11:39.724Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"
},
{
"name": "https://github.com/microsoft/kiota/issues/7912",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/issues/7912"
},
{
"name": "https://github.com/microsoft/kiota/pull/7910",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7910"
},
{
"name": "https://github.com/microsoft/kiota/pull/7913",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7913"
},
{
"name": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"
},
{
"name": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.29.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.34.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"
}
],
"source": {
"advisory": "GHSA-p5rm-jg5c-8c77",
"discovery": "UNKNOWN"
},
"title": "Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73851",
"datePublished": "2026-08-17T15:11:39.724Z",
"dateReserved": "2026-08-13T17:44:28.644Z",
"dateUpdated": "2026-08-17T15:26:40.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59867 (GCVE-0-2026-59867)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:48 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 15:35 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7888 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/cccd798… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T15:35:45.668795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T15:37:02.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:35.538Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8"
},
{
"name": "https://github.com/microsoft/kiota/pull/7888",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7888"
},
{
"name": "https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-rg4h-fpcp-2qm8",
"discovery": "UNKNOWN"
},
"title": "Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59867",
"datePublished": "2026-07-16T14:48:11.958Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:35.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59866 (GCVE-0-2026-59866)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:46 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7884 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/dc812db… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:40.596267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:26:17.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:20.823Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6"
},
{
"name": "https://github.com/microsoft/kiota/pull/7884",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7884"
},
{
"name": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4vv7-jj25-4gh6",
"discovery": "UNKNOWN"
},
"title": "Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59866",
"datePublished": "2026-07-16T14:46:50.738Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:20.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59864 (GCVE-0-2026-59864)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:45 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 00:00 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7892 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/9a18599… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T03:56:38.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:52.269Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4jwf-m4wg-8p66",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4jwf-m4wg-8p66"
},
{
"name": "https://github.com/microsoft/kiota/pull/7892",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7892"
},
{
"name": "https://github.com/microsoft/kiota/commit/9a185994a4e549b7bba3cc2beffb9736aa902e79",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/9a185994a4e549b7bba3cc2beffb9736aa902e79"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4jwf-m4wg-8p66",
"discovery": "UNKNOWN"
},
"title": "Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59864",
"datePublished": "2026-07-16T14:45:36.247Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:02:52.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59865 (GCVE-0-2026-59865)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:43 – Updated: 2026-08-17 15:03
VLAI
EPSS
VEX
Title
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7883 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/e1d6d76… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:38.534893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:26:17.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.\u003clanguage\u003e.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota\u0027s recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension\u0027s kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:03:03.236Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj"
},
{
"name": "https://github.com/microsoft/kiota/pull/7883",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7883"
},
{
"name": "https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-hq9q-27g5-qwpj",
"discovery": "UNKNOWN"
},
"title": "Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59865",
"datePublished": "2026-07-16T14:43:40.058Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:03:03.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59863 (GCVE-0-2026-59863)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:42 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 15:22 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7885 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/4049327… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T15:22:52.387399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T15:33:19.970Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\\\ or // paths, Windows drive X:\\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:40.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m"
},
{
"name": "https://github.com/microsoft/kiota/pull/7885",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7885"
},
{
"name": "https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"source": {
"advisory": "GHSA-4rj6-vrwv-wr8m",
"discovery": "UNKNOWN"
},
"title": "Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59863",
"datePublished": "2026-07-16T14:42:02.337Z",
"dateReserved": "2026-07-07T15:41:53.607Z",
"dateUpdated": "2026-08-17T15:02:40.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59859 (GCVE-0-2026-59859)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:40 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in the PHP Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7863 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/5e2a211… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:37.664979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:29:05.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota\u0027s PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj-\u003eprop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:29.204Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j"
},
{
"name": "https://github.com/microsoft/kiota/pull/7863",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7863"
},
{
"name": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4"
}
],
"source": {
"advisory": "GHSA-jqwh-526h-c92j",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in the PHP Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59859",
"datePublished": "2026-07-16T14:40:27.319Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:29.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59862 (GCVE-0-2026-59862)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:38 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in the Python Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/releases/tag/v1.32.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:36.677843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:43.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota\u0027s Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:15.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0"
}
],
"source": {
"advisory": "GHSA-7f3j-j7jj-r3vr",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in the Python Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59862",
"datePublished": "2026-07-16T14:38:59.471Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:15.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59861 (GCVE-0-2026-59861)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:36 – Updated: 2026-08-17 15:02
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7746 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/fee1b64… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:35.781411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:44.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota\u0027s Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:02:02.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw"
},
{
"name": "https://github.com/microsoft/kiota/pull/7746",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7746"
},
{
"name": "https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0"
}
],
"source": {
"advisory": "GHSA-xg2h-5xr2-29jw",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection in Kiota Ruby Generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59861",
"datePublished": "2026-07-16T14:36:32.010Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:02:02.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59860 (GCVE-0-2026-59860)
Vulnerability from cvelistv5 – Published: 2026-07-16 14:34 – Updated: 2026-08-17 15:01
VLAI
EPSS
VEX
Title
Kiota: XML Doc-Comment Newline Breakout Code Injection
Summary
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 03:56 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
| https://github.com/microsoft/kiota/pull/7831 | x_refsource_MISC |
| https://github.com/microsoft/kiota/commit/ebb632d… | x_refsource_MISC |
| https://github.com/microsoft/kiota/releases/tag/v1.32.3 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T03:56:34.813340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T19:26:44.335Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// \u2026 comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:01:37.307Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"
},
{
"name": "https://github.com/microsoft/kiota/pull/7831",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/pull/7831"
},
{
"name": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44"
},
{
"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.3"
}
],
"source": {
"advisory": "GHSA-3hrf-2gc2-mx32",
"discovery": "UNKNOWN"
},
"title": "Kiota: XML Doc-Comment Newline Breakout Code Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59860",
"datePublished": "2026-07-16T14:34:24.549Z",
"dateReserved": "2026-07-07T15:41:53.606Z",
"dateUpdated": "2026-08-17T15:01:37.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41134 (GCVE-0-2026-41134)
Vulnerability from cvelistv5 – Published: 2026-04-22 20:20 – Updated: 2026-08-17 15:01
VLAI
EPSS
VEX
Title
Kiota: Code Generation Literal Injection
Summary
Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-25 03:55 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/microsoft/kiota/security/advis… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-25T03:55:47.201212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-27T13:35:02.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kiota",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.30.0, \u003c 1.31.1"
},
{
"status": "affected",
"version": "\u003c 1.29.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:01:15.166Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-2hx3-vp6r-mg3f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-2hx3-vp6r-mg3f"
}
],
"source": {
"advisory": "GHSA-2hx3-vp6r-mg3f",
"discovery": "UNKNOWN"
},
"title": "Kiota: Code Generation Literal Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-41134",
"datePublished": "2026-04-22T20:20:57.541Z",
"dateReserved": "2026-04-17T12:59:15.738Z",
"dateUpdated": "2026-08-17T15:01:15.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}