Microsoft.OpenAPI.Kiota vulnerabilities
CVEs whose affected-version data names the Microsoft.OpenAPI.Kiota package (nuget). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
12 CVEsRSS
CVE-2026-105796High· 8.8Kiota is an OpenAPI based HTTP Client code generator
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to refor…
CVE-2026-105795Low· 3.1Kiota is an OpenAPI based HTTP Client code generator
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin …
CVE-2026-59860HighMicrosoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
CVE-2026-59861High· 7.5Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
CVE-2026-59862High· 7.5Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
CVE-2026-59859HighMicrosoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
CVE-2026-59864CriticalMicrosoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
CVE-2026-59867High· 7.1Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
CVE-2026-59863HighMicrosoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
CVE-2026-59865CriticalMicrosoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
CVE-2026-59866HighMicrosoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
GHSA-p5rm-jg5c-8c77MediumMicrosoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)