{"data":{"id":"bea87d95-44b6-46af-a51c-65dfba81cd5a","title":"CVE-2026-59864: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate`…","summary":"Kiota versions prior to 1.32.5 generate Microsoft 365 Copilot and Teams plugin manifests with `static_template.file` values taken from `x-ai-adaptive-card` and `x-ai-capabilities` without path validation, via `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`). Attacker-controlled values such as `../`, absolute, UNC, or Windows drive paths can cause path traversal or out-of-package file inclusion when the generated plugin is deployed.","solution":"Fixed in 1.32.5.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59864","publishedAt":"2026-07-16T16:19:15.240Z","cveId":"CVE-2026-59864","cweIds":["CWE-22","CWE-829"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["Microsoft.OpenApi.Kiota@>= 1.30.0, < 1.32.5 (fixed: 1.32.5)","Microsoft.OpenApi.Kiota.Builder@>= 1.30.0, < 1.32.5 (fixed: 1.32.5)","Microsoft.OpenApi.Kiota@< 1.29.1 (fixed: 1.29.1)","Microsoft.OpenApi.Kiota.Builder@< 1.29.1 (fixed: 1.29.1)"],"affectedPackageNames":["microsoft-openapi-kiota","microsoft-openapi-kiota-builder"],"affectedPackageRefs":["nuget:microsoft-openapi-kiota","nuget:microsoft-openapi-kiota-builder"],"affectedVendors":["Microsoft"],"affectedVendorsRaw":["Microsoft 365 Copilot","Microsoft Teams","Kiota APIPlugin"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kiota plugin generation path traversal through static_template file values","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01331,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-4jwf-m4wg-8p66"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:34.600Z","patchAvailable":true,"disclosureDate":"2026-07-16T16:19:15.240Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:33:05.006Z","capecIds":["CAPEC-126","CAPEC-437"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.32.5","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:33:04.858Z"},{"ecosystem":null,"name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.29.1","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:33:04.858Z"},{"ecosystem":null,"name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.32.5","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:33:04.858Z"},{"ecosystem":null,"name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.29.1","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:33:04.858Z"}]}}