Kiota EUVD-2026-44929

Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write

Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat

Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta

{...}, $var, or {$obj->prop} are emitted verbatim inside PHP double-quoted literals and interpolated as code when the ge

{}//') demonstrating the break-out.

Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a

{expr}, #$var, or #@var markers are treated as live Ruby interpolation inside generated model classes. There is no publi

Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti

Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr