# CVE-2026-59866: Microsoft Kiota path traversal and code injection in OpenAPI generation

Source: https://junglewise.ai/threats/cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-59866 · Severity: high · CVSS 4 · Published 2026-07-16

Microsoft Kiota, a tool used by developers to generate API client libraries, contains a vulnerability that allows an attacker to write files to arbitrary locations on a developer's machine or CI/CD server. By providing a specially crafted API description file, an attacker can trick the tool into creating or overwriting files outside of the intended project directory. This could lead to system corruption, build failures, or the placement of malicious files in sensitive locations.

Technologies: [Microsoft Kiota](https://junglewise.ai/threats/technologies/kiota), [Microsoft.OpenApi.Kiota](https://junglewise.ai/threats/technologies/microsoft-openapi-kiota), [Microsoft.OpenApi.Kiota.Builder](https://junglewise.ai/threats/technologies/microsoft-openapi-kiota-builder), [Microsoft.OpenApi.Kiota (NuGet)](https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota), [Microsoft.OpenApi.Kiota.Builder (NuGet)](https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-59866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59866 being exploited in the wild.

**How severe is CVE-2026-59866?** High severity, with a CVSS score of 4, published 16 July 2026.

**Which products and versions are affected?** Microsoft Kiota < 1.32.5; Microsoft.OpenApi.Kiota < 1.32.5; Microsoft.OpenApi.Kiota.Builder < 1.32.5; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.32.5; and 1 more.

**Is there a fix for CVE-2026-59866?** Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59866 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59866?** Check whether you run Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.5 or later

  ```sh
  dotnet add package Microsoft.OpenApi.Kiota --version 1.32.5
  ```

- Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.5 or later

  ```sh
  dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.5
  ```


## Technical details

Microsoft Kiota fails to sanitize the 'clientClassName' and 'clientNamespaceName' values from the 'x-ms-kiota-info' OpenAPI extension. These values are used directly in file path construction and source code generation. An attacker who controls the OpenAPI description can use path traversal sequences (CWE-22) to write generated files outside the specified output directory or inject arbitrary text (CWE-94) into the generated class declarations. While the code injection typically breaks the build due to syntax errors, the arbitrary file write primitive allows for overwriting sensitive files. The vulnerability is fixed in version 1.32.5 by implementing strict character sanitization for these fields.

## Affected products

- Microsoft Microsoft.OpenApi.Kiota < 1.32.5
- Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.5

## Identifiers

- CVE-2026-59866
- GHSA-4vv7-jj25-4gh6

## Timeline

- 2026-07-03: disclosed: Initial disclosure to vendor
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published and fix confirmed in 1.32.5

## References

- [https://api.github.com/users/Gal3m](https://api.github.com/users/Gal3m)
- [https://github.com/Gal3m](https://github.com/Gal3m)
- [https://api.github.com/users/Gal3m/gists%7B/gist_id%7D](https://api.github.com/users/Gal3m/gists%7B/gist_id%7D)
- [https://api.github.com/users/Gal3m/repos](https://api.github.com/users/Gal3m/repos)
- [https://avatars.githubusercontent.com/u/91008976?v=4](https://avatars.githubusercontent.com/u/91008976?v=4)
- [https://api.github.com/users/Gal3m/events%7B/privacy%7D](https://api.github.com/users/Gal3m/events%7B/privacy%7D)

## Related threats

- [Microsoft Kiota documentation-comment injection in Java and PHP](https://junglewise.ai/threats/cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0)
- [Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests](https://junglewise.ai/threats/cve-2026-105795-kiota-is-an-openapi-based-http-client-code-generator-from-1-25-1)
- [Microsoft Kiota path traversal in plugin manifest via percent-encoding bypass](https://junglewise.ai/threats/cve-2026-73851-microsoft-kiota-path-traversal-in-plugin-manifest-via-percent)
- [Microsoft Kiota SSRF and File Inclusion via OpenAPI external references](https://junglewise.ai/threats/cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external)
- [Microsoft Kiota command injection in kiota info via OpenAPI extension](https://junglewise.ai/threats/cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi)