CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.

CVSS

No CVSS.

References

Link	Resource
https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9
https://github.com/microsoft/kiota/pull/7885
https://github.com/microsoft/kiota/releases/tag/v1.32.5
https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.5, Kiota respetaba una configuración de espacio de trabajo .kiota/workspace.json envenenada sin validar los valores de outputPath por cliente o por plugin durante kiota client generate y kiota plugin generate, permitiendo que un repositorio malicioso o una solicitud de extracción utilizara rutas absolutas, rutas POSIX / con raíz, rutas UNC \\ o //, rutas de unidad de Windows X:\, o segmentos de recorrido .. para escribir archivos de cliente generados fuera de la raíz del espacio de trabajo en un host de desarrollador o CI. Este problema está solucionado en la versión 1.32.5.

Information

Published : 2026-07-16 15:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-59863

Mitre link : CVE-2026-59863

CVE.ORG link : CVE-2026-59863

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-59863", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59863", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T15:22:52.387399Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-07-16T15:16:35.707", "references": [{"url": "https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7885", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\\\ or // paths, Windows drive X:\\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.5, Kiota respetaba una configuraci\u00f3n de espacio de trabajo .kiota/workspace.json envenenada sin validar los valores de outputPath por cliente o por plugin durante kiota client generate y kiota plugin generate, permitiendo que un repositorio malicioso o una solicitud de extracci\u00f3n utilizara rutas absolutas, rutas POSIX / con ra\u00edz, rutas UNC \\\\ o //, rutas de unidad de Windows X:\\, o segmentos de recorrido .. para escribir archivos de cliente generados fuera de la ra\u00edz del espacio de trabajo en un host de desarrollador o CI. Este problema est\u00e1 solucionado en la versi\u00f3n 1.32.5."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}