CVE-2026-59863 Details
Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.
A vulnerability in Microsoft Kiota prior to version 1.32.5 allows for arbitrary file writes outside the designated workspace directory. This issue arises because Kiota does not validate output path settings in the workspace configuration file, .kiota/workspace.json, before generating client or plugin files. As a result, a malicious repository or pull request can exploit this by specifying output paths that escape the workspace root, including absolute paths and certain traversal sequences. When the kiota client generate or kiota plugin generate commands are executed, the generated files are written to the attacker-controlled locations on the developer's or CI host's filesystem.
Users should upgrade to Microsoft Kiota version 1.32.5 or later. It is also advisable to review any committed workspace configurations for outputPath values that point outside the workspace.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9 | [email protected] | Source CodeVendor |
| https://github.com/microsoft/kiota/pull/7885 | [email protected] | Issue TrackingVendor |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | [email protected] | Release NotesVendor |
| https://github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft Kiota | < 1.32.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |