Sign in
Deutsch English Español Polski
High

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

  • Disclosed: 24.07.2026
  • Updated: 11.10.2026 11:23

Summary

Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — the outputPath was not confined to the workspace root and absolute paths were accepted.

Confirmed on Kiota 1.32.4 (KIOTA_CONFIG_PREVIEW=true, the self-contained linux-x64 release binary).

Details

jsonc
// .kiota/workspace.json (committed to the repo)
"clients": { "MyClient": {
   "outputPath": "/abs/path/outside/repo/pwned_client"   // -> generated client written here (CWE-22)
}}

Running kiota client generate --client-name MyClient in the repo writes MyClient.cs, P/PRequestBuilder.cs, … to the attacker-chosen outputPath (verified outside the working tree).

Note on descriptionLocation

The per-consumer descriptionLocation is intentionally fetched at generation time — this is how Kiota knows where to pull an updated description from when refreshing a client, the same way any other value in a committed lock/config file is honored. It is not treated as a vulnerability and is unchanged; only outputPath is now confined.

Impact

A malicious or compromised repository — or a malicious PR that edits .kiota/workspace.json — leads to arbitrary file write on the developer's or CI host's filesystem (overwrite source/build files, drop files in auto-loaded locations) whenever a teammate clones/pulls and runs the documented kiota client generate / kiota plugin generate to refresh the client. CWE-22.

This is a different trust boundary from the OpenAPI-description-based findings: the malicious input is the Kiota config, not the spec.

Patches

Fixed in 1.29.1 and 1.32.5 (https://github.com/microsoft/kiota/pull/7885). On loading a workspace configuration, each client/plugin outputPath is validated to be a relative subdirectory of the workspace: null/empty, rooted paths (POSIX /, UNC \\ / //, Windows drive X:\), and any .. traversal segment are rejected, and the resolved full path must stay under the workspace root. Generation aborts with an error if any consumer's outputPath escapes the workspace.

Remediation

Upgrade to Kiota 1.29.1, 1.32.5 or later. Review any committed workspace configs for outputPath values that point outside the workspace.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
.NET (NuGet) Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
.NET (NuGet) Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-22, CWE-829, CWE-918
Platform
.NET (NuGet)
Package
Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder
Disclosed
24.07.2026
Updated
11.10.2026 11:23

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4rj6-vrwv-wr8m - CC BY 4.0

Vulnerability history: Microsoft.OpenApi.Kiota.Builder

All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive
Total entries
12
First → latest
04.2026 10.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 9
  • Low 1

Disclosures per year

Severity:
  1. Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
    High · 8.8 CVE-2026-105796 >= 0.5.0, < 1.35.0 1.35.0
  2. Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
    High CVE-2026-59866 >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
  3. Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
    Critical CVE-2026-59865 >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
  4. Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF this entry
    High CVE-2026-59863 >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
  5. Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
    High · 7.1 CVE-2026-59867 >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
  6. Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
    Critical CVE-2026-59864 >= 1.30.0, < 1.32.5, < 1.29.1 1.32.5, 1.29.1
  7. Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
    High CVE-2026-59859 >= 1.30.0, < 1.32.4, < 1.29.1 1.32.4, 1.29.1
  8. Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
    High · 7.5 CVE-2026-59862 >= 1.30.0, < 1.32.0, < 1.29.1 1.32.0, 1.29.1
  9. Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
    High · 7.5 CVE-2026-59861 >= 1.30.0, < 1.32.0, < 1.29.1 1.32.0, 1.29.1
  10. Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
    High CVE-2026-59860 >= 1.30.0, < 1.32.3, < 1.29.1 1.32.3, 1.29.1
  11. Kiota: Code Generation Literal Injection
    High · 0.0 CVE-2026-41134 >= 1.30.0, < 1.31.1, < 1.29.1 1.31.1, 1.29.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.