EUVD-2026-44936Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker-supplied spec is fetched over network (AV:N) but a developer must run the generator (UI:R); write outside -o escapes the tool's scope (S:C); impact is file-write and code injection (I:H), not disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota generate ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
AnalysisAI
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write generated source files outside the intended output directory and inject arbitrary text into class/namespace declarations. When a developer runs kiota generate without the -c/--class-name flag, Kiota consumes the clientClassName and clientNamespaceName values from the OpenAPI x-ms-kiota-info extension without identifier or path sanitization, using them both as code identifiers and as filesystem path components. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a developer to run `kiota generate` WITHOUT the -c/--class-name option against an attacker-controlled or compromised OpenAPI description in which the `x-ms-kiota-info` extension supplies malicious clientClassName and/or clientNamespaceName values (path-separator or `..` sequences for directory escape, or identifier-breaking characters for code injection). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.3 Critical and models fully unauthenticated remote impact, but this understates the practical precondition: exploitation is not a remote hit against a running service - it requires a developer to run `kiota generate` against an attacker-supplied or compromised OpenAPI description, and specifically without -c/--class-name. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or tampers with an OpenAPI description hosted at a URL a developer consumes, embedding an `x-ms-kiota-info` extension whose clientNamespaceName contains `../../` traversal and whose clientClassName carries injected declaration text. When the developer runs `kiota generate -o ./client` without -c, Kiota writes generated source outside ./client and emits the attacker's text into class/namespace declarations, which is compiled into the project. … |
| Remediation | Vendor-released patch: upgrade Kiota to 1.32.5 or later, which sanitizes clientClassName and clientNamespaceName from settings and the `x-ms-kiota-info` extension before using them in code or file paths (see release https://github.com/microsoft/kiota/releases/tag/v1.32.5 and advisory https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Although no public exploit has been identified at time of analysis, immediately inventory all Microsoft Kiota deployments across development and CI/CD infrastructure to identify versions prior to 1.32.5, and halt processing of OpenAPI specifications from external or untrusted sources within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
{...}, $var, or {$obj->prop} are emitted verbatim inside PHP double-quoted literals and interpolated as code when the ge
{}//') demonstrating the break-out.
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
{expr}, #$var, or #@var markers are treated as live Ruby interpolation inside generated model classes. There is no publi
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today