Skip to content
OpenAdvisories

Product · Microsoft

Microsoft.OpenApi.Kiota.Builder

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-105795

    Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

    Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without valid…

    Microsoft kiota Microsoft.OpenApi.Kiota Microsoft.OpenApi.Kiota.Builder NuGet