CVE-2026-59864
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A vulnerability in Kiota before version 1.32.5 allows an attacker to inject paths into static template files in Microsoft 365 Copilot and Teams plugin manifests. Lack of path validation in the static_template.file parameter enables the use of ../ sequences, absolute, rooted, UNC, Windows drive, or URI paths, leading to path traversal or out-of-package file inclusion.
Risk Assessment
The organization is at risk of malicious static files being injected into plugin manifests, potentially leading to unauthorized data access or code execution in the Copilot/Teams environment.
Recommendation
Immediately update Kiota to version 1.32.5 or later. After updating, verify all generated plugin manifests for improper paths.
Original NVD description (English source)
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.32.5.