CVE-2026-105795

The Kiota OpenAPI-based HTTP Client code generator versions 1.25.1 through 1.35.0 are vulnerable to an improper limitation of pathnames (CWE-22 ). The software fails to validate the x-ai-capabilities.response_semantics.oauth_card_path value when copying it from an attacker-controlled or compromis...