Executive brief
Microsoft Kiota, a tool used by developers to generate API client libraries, contains a vulnerability that allows an attacker to write files to arbitrary locations on a developer's machine or CI/CD server. By providing a specially crafted API description file, an attacker can trick the tool into creating or overwriting files outside of the intended project directory. This could lead to system corruption, build failures, or the placement of malicious files in sensitive locations.
Technical details
Microsoft Kiota fails to sanitize the 'clientClassName' and 'clientNamespaceName' values from the 'x-ms-kiota-info' OpenAPI extension. These values are used directly in file path construction and source code generation. An attacker who controls the OpenAPI description can use path traversal sequences (CWE-22) to write generated files outside the specified output directory or inject arbitrary text (CWE-94) into the generated class declarations. While the code injection typically breaks the build due to syntax errors, the arbitrary file write primitive allows for overwriting sensitive files. The vulnerability is fixed in version 1.32.5 by implementing strict character sanitization for these fields.
Affected products
- Microsoft Microsoft.OpenApi.Kiota < 1.32.5
- Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.5
Timeline
- 2026-07-03: disclosed: Initial disclosure to vendor
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published and fix confirmed in 1.32.5