EUVD-2026-60233Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires developer interaction to process malicious spec (UI:R); impact is on the downstream AI host system (S:C, C:H); no integrity or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
AnalysisAI
Path traversal in Microsoft Kiota's AI plugin manifest generator allows an attacker who controls or tampers with the OpenAPI description input to inject percent-encoded file references - including double-encoded sequences, NUL-byte payloads, and Unicode full-width homoglyphs - that bypass the IsSafeFileReference validator and are written verbatim into the generated plugin manifest. When an AI host deploys and resolves the manifest, it can access files outside the intended package boundary, leading to disclosure of sensitive files such as /etc/passwd. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control or tamper with the OpenAPI description consumed by Kiota - for example, via a compromised upstream API spec repository, substitution of a remotely fetched spec via a man-in-the-middle position, or a developer deliberately or inadvertently using a malicious spec. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.1 (Medium) accurately reflects the split impact model: Kiota itself sustains no direct impact (VC:N/VI:N/VA:N), but the subsequent system - the AI host consuming the generated manifest - faces high confidentiality impact (SC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor who has compromised an upstream OpenAPI specification repository inserts a malicious x-ai-capabilities static_template file reference using a percent-encoded path traversal payload such as %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd. A developer or CI/CD pipeline runs a vulnerable version of Kiota against this specification; the IsSafeFileReference validator accepts the encoded reference as safe and writes it verbatim into the generated plugin manifest. … |
| Remediation | Upgrade nuget/Microsoft.OpenApi.Kiota to version 1.29.1 if on the 1.29.x branch, or to version 1.34.0 if on 1.30.x through 1.33.x; both releases are confirmed fixed per the GHSA advisory and GitHub release tags at https://github.com/microsoft/kiota/releases/tag/v1.29.1 and https://github.com/microsoft/kiota/releases/tag/v1.34.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today