CVE-2026-105796

Kiota before versions 1.29.1 and 1.32.5 did not sanitize clientClassName and clientNamespaceName values from OpenAPI descriptions, allowing generated source to be written outside the output directory and arbitrary text to be injected into class or namespace declarations.

Kiota before versions 1.29.1 and 1.32.5 displayed dependency install commands from an OpenAPI description as recommended, allowing command injection when the suggested command was run manually or via the VS Code extension.

Kiota before versions 1.29.1 and 1.32.5 in plugin add and plugin generate commands did not validate paths in the static_template.file field, allowing path traversal or out-of-package file inclusion in generated plugin manifests.

Kiota, an OpenAPI-based HTTP client code generator, from 1.25.1 to 1.35.0 copies x-ai-capabilities.response_semantics.oauth_card_path from an OpenAPI description into a generated plugin manifest without validating it as a safe package-relative file reference. This can allow crossing the plugin-package boundary or using an unintended authentication card. Fixed in version 1.35.0.

Kiota before versions 1.29.1 and 1.34.0 allows an attacker who controls or tampers with the OpenAPI description to supply a file reference that resolves outside the manifest package (e.g., ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary.

Kiota before versions 1.29.1 and 1.32.5 resolved OpenAPI $ref values by fetching remote URLs and reading local file paths, allowing SSRF, remote file inclusion, and local file inclusion during client generation.

Kiota before versions 1.29.1 and 1.32.5 honored a poisoned workspace.json configuration without validating output paths, allowing generated files to be written outside the workspace root on a developer or CI host.

Kiota before versions 1.29.1 and 1.32.0 in the Python generator did not sanitize enum value descriptions, allowing Python code injection into generated comments that could be executed when modules are imported.

Kiota before versions 1.29.1 and 1.32.0 in the Ruby generator did not escape the # character in string literals, allowing arbitrary Ruby code injection into generated model classes.

Kiota before versions 1.29.1 and 1.32.3 has a code-generation injection vulnerability in the C# XML documentation-comment sink, where text from an OpenAPI description is written without stripping newline characters, allowing injection of additional code into generated C# clients.