Skip to content
OpenAdvisories

Package · NuGet

Microsoft.OpenApi.Kiota

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-59866

    Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and genera…

    Microsoft kiota Microsoft.OpenApi.Kiota Microsoft.OpenApi.Kiota.Builder NuGet
  • Critical 9.3
    CVE-2026-59864

    Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into g…

    Microsoft kiota Microsoft.OpenApi.Kiota Microsoft.OpenApi.Kiota.Builder NuGet
  • Critical 9.3
    CVE-2026-59865

    Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the …

    Microsoft kiota Microsoft.OpenApi.Kiota Microsoft.OpenApi.Kiota.Builder NuGet