Skip to content
fr Sign in
9.3 Critical

CVE-2026-59865 Kiota is an OpenAPI based HTTP Client code generator

Description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.

Affected products and versions

Product Affected versions Fixed in
kiota 1.30 1.30.0 → < 1.31.1 1.31.1
kiota 1.29 earliest → < 1.29.1 1.29.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of kiota

The 13 CVEs of kiota →
CVE-2026-105796 Kiota is an OpenAPI based HTTP Client code generator 8.8 High CVE-2026-105795 Kiota is an OpenAPI based HTTP Client code generator 3.1 Low CVE-2026-73851 Kiota is an OpenAPI based HTTP Client code generator 6.1 Medium CVE-2026-59867 Kiota is an OpenAPI based HTTP Client code generator 7.1 High
Track this CVE