CVE-2026-59865
CriticalCVSS 9.3Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A vulnerability in Kiota prior to version 1.32.5 allows command injection by reading malicious `dependencyInstallCommand` values from an OpenAPI description. An attacker can supply a crafted description that, when the suggested install command is executed manually or via the VS Code extension, leads to arbitrary code execution.
Risk Assessment
The organization risks system compromise if developers or automated flows (e.g., VS Code extension) execute the infected dependency install command. This could lead to malware installation or data theft.
Recommendation
Immediately update Kiota to version 1.32.5 or later. Before updating, avoid using `kiota info` with untrusted OpenAPI sources and do not execute suggested install commands without manual verification.
Original NVD description (English source)
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.32.5.