microsoft kiota vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest microsoft kiota vulnerabilities

CVE-2026-105796 — Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators (CVSS 8.8)
CVE-2026-105795 — Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests (CVSS 3.1)
CVE-2026-73851 — Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass) (CVSS 6.1)
CVE-2026-59867 — Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (CVSS 7.1)
CVE-2026-59866 — Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName (CVSS 9.3)
CVE-2026-59865 — Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` (CVSS 9.3)
CVE-2026-59864 — Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions (CVSS 9.3)
CVE-2026-59863 — Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF (CVSS 7.0)
CVE-2026-59862 — Kiota: Code Generation Literal Injection in the Python Generator (CVSS 7.5)
CVE-2026-59861 — Kiota: Code Generation Literal Injection in Kiota Ruby Generator (CVSS 7.5)
CVE-2026-59860 — Kiota: XML Doc-Comment Newline Breakout Code Injection (CVSS 8.7)
CVE-2026-59859 — Kiota: Code Generation Literal Injection in the PHP Generator (CVSS 8.7)
CVE-2026-41134 — Kiota: Code Generation Literal Injection (CVSS 7.8)