{"schema_version":1,"title":"Microsoft.OpenApi.Kiota.Builder (NuGet) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Microsoft.OpenApi.Kiota.Builder (NuGet): 0 in the last 7 days and 2 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105796, was published on 6 October 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before.","url":"https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder","json_url":"https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":9,"all_time":12,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":2,"last_365_days":12},"latest":[{"cve":"CVE-2026-105796","cvss":8.8,"epss":0.009,"slug":"cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0","title":"Microsoft Kiota documentation-comment injection in Java and PHP","severity":"high","exploited":false,"published_at":"2026-10-06T15:17:16.59+00:00","url":"https://junglewise.ai/threats/cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0"},{"cve":"CVE-2026-105795","cvss":3.1,"epss":0.0121,"slug":"cve-2026-105795-kiota-is-an-openapi-based-http-client-code-generator-from-1-25-1","title":"Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests","severity":"low","exploited":false,"published_at":"2026-10-06T15:17:16.437+00:00","url":"https://junglewise.ai/threats/cve-2026-105795-kiota-is-an-openapi-based-http-client-code-generator-from-1-25-1"},{"cve":"CVE-2026-59867","cvss":7.1,"epss":0.0239,"slug":"cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external","title":"Microsoft Kiota SSRF and File Inclusion via OpenAPI external references","severity":"high","exploited":false,"published_at":"2026-07-16T16:19:15.62+00:00","url":"https://junglewise.ai/threats/cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external"},{"cve":"CVE-2026-59866","cvss":4,"epss":0.0141,"slug":"cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi","title":"Microsoft Kiota path traversal and code injection in OpenAPI generation","severity":"high","exploited":false,"published_at":"2026-07-16T16:19:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi"},{"cve":"CVE-2026-59865","cvss":4,"epss":0.0436,"slug":"cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi","title":"Microsoft Kiota command injection in kiota info via OpenAPI extension","severity":"critical","exploited":false,"published_at":"2026-07-16T16:19:15.373+00:00","url":"https://junglewise.ai/threats/cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi"},{"cve":"CVE-2026-59864","cvss":4,"epss":0.0133,"slug":"cve-2026-59864-microsoft-kiota-path-traversal-in-plugin-manifest-generation","title":"Microsoft Kiota path traversal in plugin manifest generation","severity":"critical","exploited":false,"published_at":"2026-07-16T16:19:15.24+00:00","url":"https://junglewise.ai/threats/cve-2026-59864-microsoft-kiota-path-traversal-in-plugin-manifest-generation"},{"cve":"CVE-2026-59863","cvss":4,"epss":0.0137,"slug":"cve-2026-59863-microsoft-kiota-path-traversal-in-workspace-configuration","title":"Microsoft Kiota path traversal in workspace configuration","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.707+00:00","url":"https://junglewise.ai/threats/cve-2026-59863-microsoft-kiota-path-traversal-in-workspace-configuration"},{"cve":"CVE-2026-59862","cvss":7.5,"epss":0.0138,"slug":"cve-2026-59862-microsoft-kiota-code-injection-in-python-generator","title":"Microsoft Kiota code injection in Python generator","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.57+00:00","url":"https://junglewise.ai/threats/cve-2026-59862-microsoft-kiota-code-injection-in-python-generator"},{"cve":"CVE-2026-59861","cvss":7.5,"epss":0.0205,"slug":"cve-2026-59861-microsoft-kiota-ruby-code-injection-in-generated-string-literals","title":"Microsoft Kiota Ruby code injection in generated string literals","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.44+00:00","url":"https://junglewise.ai/threats/cve-2026-59861-microsoft-kiota-ruby-code-injection-in-generated-string-literals"},{"cve":"CVE-2026-59860","cvss":4,"epss":0.0138,"slug":"cve-2026-59860-microsoft-kiota-code-injection-in-c-xml-documentation-comments","title":"Microsoft Kiota code injection in C# XML documentation comments","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.31+00:00","url":"https://junglewise.ai/threats/cve-2026-59860-microsoft-kiota-code-injection-in-c-xml-documentation-comments"},{"cve":"CVE-2026-59859","cvss":4,"epss":0.0138,"slug":"cve-2026-59859-microsoft-kiota-php-code-injection-in-generated-string-literals","title":"Microsoft Kiota PHP code injection in generated string literals","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.167+00:00","url":"https://junglewise.ai/threats/cve-2026-59859-microsoft-kiota-php-code-injection-in-generated-string-literals"},{"cve":"CVE-2026-41134","cvss":7.8,"epss":0.0035,"slug":"cve-2026-41134-microsoft-kiota-code-injection-in-generated-clients","title":"Microsoft Kiota code injection in generated clients","severity":"high","exploited":false,"published_at":"2026-04-22T21:17:09.027+00:00","url":"https://junglewise.ai/threats/cve-2026-41134-microsoft-kiota-code-injection-in-generated-clients"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Microsoft.ChakraCore (NuGet)","slug":"microsoft-chakracore","vulnerabilities":247,"url":"https://junglewise.ai/threats/technologies/microsoft-chakracore"},{"name":"Magick.NET-Q16-AnyCPU (NuGet)","slug":"magick-net-q16-anycpu","vulnerabilities":167,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-anycpu"},{"name":"Magick.NET-Q16-HDRI-AnyCPU (NuGet)","slug":"magick-net-q16-hdri-anycpu","vulnerabilities":162,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu"},{"name":"Magick.NET-Q8-AnyCPU (NuGet)","slug":"magick-net-q8-anycpu","vulnerabilities":162,"url":"https://junglewise.ai/threats/technologies/magick-net-q8-anycpu"},{"name":"Magick.NET-Q16-HDRI-x86 (NuGet)","slug":"magick-net-q16-hdri-x86","vulnerabilities":160,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86"},{"name":"Magick.NET-Q8-x86 (NuGet)","slug":"magick-net-q8-x86","vulnerabilities":160,"url":"https://junglewise.ai/threats/technologies/magick-net-q8-x86"},{"name":"Magick.NET-Q16-x86 (NuGet)","slug":"magick-net-q16-x86","vulnerabilities":159,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-x86"},{"name":"Magick.NET-Q16-arm64 (NuGet)","slug":"magick-net-q16-arm64","vulnerabilities":157,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-arm64"},{"name":"Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)","slug":"magick-net-q16-hdri-openmp-arm64","vulnerabilities":157,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64"},{"name":"Magick.NET-Q16-HDRI-x64 (NuGet)","slug":"magick-net-q16-hdri-x64","vulnerabilities":157,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64"},{"name":"Magick.NET-Q16-OpenMP-arm64 (NuGet)","slug":"magick-net-q16-openmp-arm64","vulnerabilities":157,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64"},{"name":"Magick.NET-Q16-OpenMP-x64 (NuGet)","slug":"magick-net-q16-openmp-x64","vulnerabilities":157,"url":"https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64"}],"technology":{"hub":true,"name":"Microsoft.OpenApi.Kiota.Builder (NuGet)","slug":"nuget-microsoft-openapi-kiota-builder","vendor":{"hub":true,"name":"NuGet","slug":"nuget","url":"https://junglewise.ai/threats/vendors/nuget"},"aliases":[],"description":"Microsoft Kiota builder tool for generating type-safe HTTP API client code from OpenAPI descriptions.","url":"https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder"},"most_severe":[{"cve":"CVE-2026-59865","cvss":4,"epss":0.0436,"slug":"cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi","title":"Microsoft Kiota command injection in kiota info via OpenAPI extension","severity":"critical","exploited":false,"published_at":"2026-07-16T16:19:15.373+00:00","url":"https://junglewise.ai/threats/cve-2026-59865-microsoft-kiota-command-injection-in-kiota-info-via-openapi"},{"cve":"CVE-2026-59864","cvss":4,"epss":0.0133,"slug":"cve-2026-59864-microsoft-kiota-path-traversal-in-plugin-manifest-generation","title":"Microsoft Kiota path traversal in plugin manifest generation","severity":"critical","exploited":false,"published_at":"2026-07-16T16:19:15.24+00:00","url":"https://junglewise.ai/threats/cve-2026-59864-microsoft-kiota-path-traversal-in-plugin-manifest-generation"},{"cve":"CVE-2026-105796","cvss":8.8,"epss":0.009,"slug":"cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0","title":"Microsoft Kiota documentation-comment injection in Java and PHP","severity":"high","exploited":false,"published_at":"2026-10-06T15:17:16.59+00:00","url":"https://junglewise.ai/threats/cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0"},{"cve":"CVE-2026-41134","cvss":7.8,"epss":0.0035,"slug":"cve-2026-41134-microsoft-kiota-code-injection-in-generated-clients","title":"Microsoft Kiota code injection in generated clients","severity":"high","exploited":false,"published_at":"2026-04-22T21:17:09.027+00:00","url":"https://junglewise.ai/threats/cve-2026-41134-microsoft-kiota-code-injection-in-generated-clients"},{"cve":"CVE-2026-59861","cvss":7.5,"epss":0.0205,"slug":"cve-2026-59861-microsoft-kiota-ruby-code-injection-in-generated-string-literals","title":"Microsoft Kiota Ruby code injection in generated string literals","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.44+00:00","url":"https://junglewise.ai/threats/cve-2026-59861-microsoft-kiota-ruby-code-injection-in-generated-string-literals"},{"cve":"CVE-2026-59862","cvss":7.5,"epss":0.0138,"slug":"cve-2026-59862-microsoft-kiota-code-injection-in-python-generator","title":"Microsoft Kiota code injection in Python generator","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.57+00:00","url":"https://junglewise.ai/threats/cve-2026-59862-microsoft-kiota-code-injection-in-python-generator"},{"cve":"CVE-2026-59867","cvss":7.1,"epss":0.0239,"slug":"cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external","title":"Microsoft Kiota SSRF and File Inclusion via OpenAPI external references","severity":"high","exploited":false,"published_at":"2026-07-16T16:19:15.62+00:00","url":"https://junglewise.ai/threats/cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external"},{"cve":"CVE-2026-59866","cvss":4,"epss":0.0141,"slug":"cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi","title":"Microsoft Kiota path traversal and code injection in OpenAPI generation","severity":"high","exploited":false,"published_at":"2026-07-16T16:19:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi"},{"cve":"CVE-2026-59860","cvss":4,"epss":0.0138,"slug":"cve-2026-59860-microsoft-kiota-code-injection-in-c-xml-documentation-comments","title":"Microsoft Kiota code injection in C# XML documentation comments","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.31+00:00","url":"https://junglewise.ai/threats/cve-2026-59860-microsoft-kiota-code-injection-in-c-xml-documentation-comments"},{"cve":"CVE-2026-59859","cvss":4,"epss":0.0138,"slug":"cve-2026-59859-microsoft-kiota-php-code-injection-in-generated-string-literals","title":"Microsoft Kiota PHP code injection in generated string literals","severity":"high","exploited":false,"published_at":"2026-07-16T15:16:35.167+00:00","url":"https://junglewise.ai/threats/cve-2026-59859-microsoft-kiota-php-code-injection-in-generated-string-literals"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}