CVE-2026-59865: Microsoft Kiota command injection in kiota info via OpenAPI extension

CVE-2026-59865 · Severity: critical · CVSS 4 · Published 2026-07-16

Microsoft Kiota is a tool used by developers to generate software code for interacting with web services. A security flaw allowed malicious web service descriptions to trick the tool into recommending and potentially automatically running harmful commands on a developer's computer. This could lead to a complete takeover of the developer's workstation or automated build systems if they use the Kiota command-line tool or its VS Code extension with a compromised service definition.

Technologies: Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota.Builder (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-59865 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59865 being exploited in the wild.
How severe is CVE-2026-59865?
Critical severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Microsoft Kiota < 1.32.5; Microsoft.OpenApi.Kiota < 1.32.5; Microsoft.OpenApi.Kiota.Builder < 1.32.4, < 1.32.5; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.32.5; and 1 more.
Is there a fix for CVE-2026-59865?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59865 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59865?
Check whether you run Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.32.5
  • Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later
    dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.5

Technical details

A command injection vulnerability exists in Microsoft Kiota due to improper handling of the 'x-ms-kiota-info' extension in OpenAPI descriptions. The 'kiota info' command and the associated VS Code extension would read the 'dependencyInstallCommand' field from an untrusted OpenAPI spec and present or execute it as a trusted recommendation. An attacker can provide a crafted OpenAPI description containing malicious shell commands in this field. When a developer runs 'kiota info' or uses the IDE extension to install dependencies, the attacker-controlled command is executed with the privileges of the user. The fix in version 1.32.5 removes support for spec-supplied install commands entirely.

Affected products

  • Microsoft Microsoft.OpenApi.Kiota < 1.32.5
  • Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.5

Identifiers

  • CVE-2026-59865
  • GHSA-hq9q-27g5-qwpj

Timeline

  • 2026-07-03: disclosed: Initial disclosure to Microsoft
  • 2026-07-16: advisory: NVD publication date
  • 2026-07-24: patched: GitHub Advisory published and fix confirmed in 1.32.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.