# Microsoft.OpenApi.Kiota (NuGet) vulnerabilities 13 known vulnerabilities (3 critical, 8 high, 1 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.38.0 (Nov 2, 2026): no advisory affects it - Newest unaffected release: 1.38.0 (Nov 2, 2026), the latest release - Releases: 159 since 1.0.0 (Mar 9, 2023) - Registry: https://www.nuget.org/packages/Microsoft.OpenApi.Kiota - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-105796: 0.5.1-preview to 1.34.1 (1.35.0 is outside it) - CVE-2026-105795: 1.25.1 to 1.34.1 (1.35.0 is outside it) - CVE-2026-73851: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.33.0 (1.34.0 is outside it) - CVE-2026-59867: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it) - CVE-2026-59866: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it) - CVE-2026-59864: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it) - CVE-2026-59865: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it) - CVE-2026-59863: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.4 (1.32.5 is outside it) - CVE-2026-59859: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.3 (1.32.4 is outside it) - CVE-2026-59862: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.1 (1.32.0 is outside it) - CVE-2026-59861: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.1 (1.32.0 is outside it) - CVE-2026-59860: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.32.2 (1.32.3 is outside it) - CVE-2026-41134: 0.1.0-preview to 1.29.0 (1.29.1 is outside it); 1.30.0 to 1.31.0 (1.31.1 is outside it) ## Advisories (13) ### [CVE-2026-105796](https://cve.now/CVE-2026-105796): Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators - Severity: High 8.8 - Published: Oct 6, 2026 - Affected: from 0.5.0, fixed in 1.35.0. - Fixed in 1.35.0 (released Sep 3, 2026, 33 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-105795](https://cve.now/CVE-2026-105795): Kiota: Unsafe oauth\_card\_path references in Kiota-generated API plugin manifests - Severity: Low 3.1 - Published: Oct 6, 2026 - Affected: from 1.25.1, fixed in 1.35.0. - Fixed in 1.35.0 (released Sep 3, 2026, 33 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-73851](https://cve.now/CVE-2026-73851): Kiota: Path traversal in generated plugin manifest static\_template.file reference (percent-encoding bypass) - Severity: Medium 6.1 - Published: Aug 17, 2026 - Affected: from 1.30.0, fixed in 1.34.0; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 3 days before disclosure) and 1.34.0 (released Jul 8, 2026, 40 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59867](https://cve.now/CVE-2026-59867): Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref - Severity: High 7.1 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59866](https://cve.now/CVE-2026-59866): Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName - Severity: Critical 9.3 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59864](https://cve.now/CVE-2026-59864): Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions - Severity: Critical 9.3 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59865](https://cve.now/CVE-2026-59865): Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by \`kiota info\` - Severity: Critical 9.3 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59863](https://cve.now/CVE-2026-59863): Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF - Severity: High 7.0 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.5; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.5 (released Jul 3, 2026, 13 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59859](https://cve.now/CVE-2026-59859): Kiota: Code Generation Literal Injection in the PHP Generator - Severity: High 8.7 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.4; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.4 (released Jun 26, 2026, 20 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59862](https://cve.now/CVE-2026-59862): Kiota: Code Generation Literal Injection in the Python Generator - Severity: High 7.5 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.0; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.0 (released Jun 2, 2026, 44 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59861](https://cve.now/CVE-2026-59861): Kiota: Code Generation Literal Injection in Kiota Ruby Generator - Severity: High 7.5 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.0; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.0 (released Jun 2, 2026, 44 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-59860](https://cve.now/CVE-2026-59860): Kiota: XML Doc-Comment Newline Breakout Code Injection - Severity: High 8.7 - Published: Jul 16, 2026 - Affected: from 1.30.0, fixed in 1.32.3; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 29 days after disclosure) and 1.32.3 (released Jun 25, 2026, 21 days before disclosure). - The latest release, 1.38.0, is not affected. ### [CVE-2026-41134](https://cve.now/CVE-2026-41134): Kiota: Code Generation Literal Injection - Severity: High 7.3 - Published: Apr 22, 2026 - Affected: from 1.30.0, fixed in 1.31.1; fixed in 1.29.1. - Fixed in 1.29.1 (released Aug 14, 2026, 114 days after disclosure) and 1.31.1 (released Apr 13, 2026, 9 days before disclosure). - The latest release, 1.38.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/microsoft.openapi.kiota Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.