NuGetPackage

Microsoft.OpenApi.Kiota

13 known vulnerabilities (3 critical, 8 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 1.38.0 (Nov 2, 2026): no advisory affects it
Newest unaffected release: 1.38.0 (Nov 2, 2026), the latest release
Advisories: 13 · 3 critical, 8 high, 1 medium, 1 low

Releases: 159 since 1.0.0 (Mar 9, 2023)
Registry: NuGet
Releases read: Nov 8, 2026

Version timeline

CVE-2026-105796
Affects 0.5.1-preview to 1.34.1 (1.35.0 is outside it)
CVE-2026-105795
Affects 1.25.1 to 1.34.1 (1.35.0 is outside it)
CVE-2026-73851
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.33.0 (1.34.0 is outside it)
CVE-2026-59867
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it)
CVE-2026-59866
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it)
CVE-2026-59864
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it)
CVE-2026-59865
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it)
CVE-2026-59863
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it)
CVE-2026-59859
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.3 (1.32.4 is outside it)
CVE-2026-59862
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.1 (1.32.0 is outside it)
CVE-2026-59861
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.1 (1.32.0 is outside it)
CVE-2026-59860
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.2 (1.32.3 is outside it)
CVE-2026-41134
Affects 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.0 (1.31.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

CVE-2026-105796High 8.8
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Affected: from 0.5.0, fixed in 1.35.0.
Fixed in 1.35.0 (released Sep 3, 2026, 33 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-105795Low 3.1
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Affected: from 1.25.1, fixed in 1.35.0.
Fixed in 1.35.0 (released Sep 3, 2026, 33 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-73851Medium 6.1
Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Affected: from 1.30.0, fixed in 1.34.0; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 3 days before disclosure) and 1.34.0 (released Jul 8, 2026, 40 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59867High 7.1
Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59866Critical 9.3
Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59864Critical 9.3
Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions
Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59865Critical 9.3
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59863High 7.0
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59859High 8.7
Kiota: Code Generation Literal Injection in the PHP Generator
Affected: from 1.30.0, fixed in 1.32.4; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.4 (released Jun 26, 2026, 20 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59862High 7.5
Kiota: Code Generation Literal Injection in the Python Generator
Affected: from 1.30.0, fixed in 1.32.0; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.0 (released Jun 2, 2026, 44 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59861High 7.5
Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Affected: from 1.30.0, fixed in 1.32.0; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.0 (released Jun 2, 2026, 44 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-59860High 8.7
Kiota: XML Doc-Comment Newline Breakout Code Injection
Affected: from 1.30.0, fixed in 1.32.3; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.3 (released Jun 25, 2026, 21 days before disclosure).
The latest release, 1.38.0, is not affected.
CVE-2026-41134High 7.3
Kiota: Code Generation Literal Injection
Affected: from 1.30.0, fixed in 1.31.1; fixed in 1.29.1.
Fixed in 1.29.1 (released Aug 14, 2026, 114 days after disclosure) and 1.31.1 (released Apr 13, 2026, 9 days before disclosure).
The latest release, 1.38.0, is not affected.