CVE-2026-59863: Microsoft Kiota path traversal in workspace configuration

CVE-2026-59863 · Severity: high · CVSS 4 · Published 2026-07-16

Microsoft Kiota, a tool used by developers to generate API clients, contains a vulnerability that allows a malicious project configuration to write files to unintended locations on a user's computer. If a developer or automated system runs the tool on a repository containing a poisoned configuration file, an attacker could overwrite critical system or project files. This could lead to unauthorized code execution or the compromise of build environments.

Technologies: Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota.Builder (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-59863 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59863 being exploited in the wild.
How severe is CVE-2026-59863?
High severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Microsoft Kiota < 1.32.5; Microsoft.OpenApi.Kiota < 1.32.5; Microsoft.OpenApi.Kiota.Builder < 1.32.5; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.32.5; and 1 more.
Is there a fix for CVE-2026-59863?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59863 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59863?
Check whether you run Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.32.5
  • Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.5

Technical details

A path traversal vulnerability (CWE-22) exists in Microsoft Kiota versions prior to 1.32.5. The tool fails to validate the 'outputPath' parameter within the '.kiota/workspace.json' configuration file, which is often committed to version control. An attacker can provide an absolute path or use traversal segments (e.g., '../') to force the tool to write generated API client files to arbitrary locations on the host filesystem when 'kiota client generate' or 'kiota plugin generate' is executed. This requires user interaction, such as a developer or CI/CD pipeline processing a malicious repository or pull request. The fix introduces validation to ensure the output path remains a relative subdirectory of the workspace root.

Affected products

  • Microsoft Microsoft.OpenApi.Kiota < 1.32.5
  • Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.5

Identifiers

  • CVE-2026-59863
  • GHSA-4rj6-vrwv-wr8m

Timeline

  • 2026-07-03: disclosed: Initial disclosure in microsoft/kiota repository
  • 2026-07-16: advisory: NVD publication date
  • 2026-07-24: advisory: GitHub Advisory Database publication date
  • 2026-07-24: patched: Fixed in version 1.32.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.