CVE-2026-59865 Details
Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.
A command injection vulnerability has been identified in Microsoft Kiota versions prior to 1.32.5. The issue arises in the 'kiota info' command, which reads dependency installation commands from the OpenAPI description 'x-ms-kiota-info' extension. This functionality allowed an attacker to inject malicious commands that could be executed in the shell, leading to potential remote code execution. The vulnerability was particularly concerning because the injected commands could be executed automatically through the Kiota VS Code extension.
Users can upgrade to Microsoft Kiota version 1.32.5 or later to address this vulnerability. Additionally, those using the Kiota VS Code extension should update to a version that is compatible with Kiota 1.32.5 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6 | [email protected] | Source CodeVendor |
| https://github.com/microsoft/kiota/pull/7883 | [email protected] | Issue TrackingVendor |
| https://github.com/microsoft/kiota/releases/tag/v1.32.5 | [email protected] | Release NotesVendor |
| https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft Kiota | < 1.32.5 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |