Microsoft Openapi Kiota Builder
Monthly
Code injection in Microsoft Kiota 0.5.0 through pre-1.35.0 allows attacker-controlled text embedded in an OpenAPI description to break out of the generated Java or PHP documentation comment and execute in the consuming application or build environment once that generated source is compiled and loaded (Java) or loaded (PHP). The flaw is reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction: a developer or CI pipeline must generate client code from an untrusted or tampered spec and then build or load the output, making this a build-time/supply-chain path rather than an attack on already-deployed runtime services. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; CVSS 3.1 base score is 8.8, and the issue is fixed in 1.35.0.
Microsoft Kiota, the OpenAPI-based HTTP client code generator, fails to validate the x-ai-capabilities.response_semantics.oauth_card_path value before copying it into a generated API plugin manifest, allowing path-traversal or absolute-URI references to survive into the manifest in versions 1.25.1 through 1.34.x. An attacker who controls or compromises the OpenAPI description can inject a malicious oauth_card_path (for example '../../../../etc/passwd', 'C:\\Windows\\...', a UNC path, or 'file:///etc/passwd') so that a downstream host resolving the plugin manifest crosses the intended plugin-package boundary or loads an unintended authentication card. The attacker vector is network-based and unauthenticated (PR:N), but exploitation requires a developer to actively run Kiota generation against the malicious description and a separate downstream consumer to resolve the reference; Kiota performs no file read or code execution during generation itself, so impact is limited to low integrity (I:L) and there is no public exploit identified at time of analysis. The issue is fixed in version 1.35.0.
Code injection in Microsoft Kiota 0.5.0 through pre-1.35.0 allows attacker-controlled text embedded in an OpenAPI description to break out of the generated Java or PHP documentation comment and execute in the consuming application or build environment once that generated source is compiled and loaded (Java) or loaded (PHP). The flaw is reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction: a developer or CI pipeline must generate client code from an untrusted or tampered spec and then build or load the output, making this a build-time/supply-chain path rather than an attack on already-deployed runtime services. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; CVSS 3.1 base score is 8.8, and the issue is fixed in 1.35.0.
Microsoft Kiota, the OpenAPI-based HTTP client code generator, fails to validate the x-ai-capabilities.response_semantics.oauth_card_path value before copying it into a generated API plugin manifest, allowing path-traversal or absolute-URI references to survive into the manifest in versions 1.25.1 through 1.34.x. An attacker who controls or compromises the OpenAPI description can inject a malicious oauth_card_path (for example '../../../../etc/passwd', 'C:\\Windows\\...', a UNC path, or 'file:///etc/passwd') so that a downstream host resolving the plugin manifest crosses the intended plugin-package boundary or loads an unintended authentication card. The attacker vector is network-based and unauthenticated (PR:N), but exploitation requires a developer to actively run Kiota generation against the malicious description and a separate downstream consumer to resolve the reference; Kiota performs no file read or code execution during generation itself, so impact is limited to low integrity (I:L) and there is no public exploit identified at time of analysis. The issue is fixed in version 1.35.0.