Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics statictemplate or the adaptive-card extension x-ai-adaptive-card, the file reference is written into the generated manifest's...

GHSA-P5RM-JG5C-8C77 Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics statictemplate or the adaptive-card extension x-ai-adaptive-card, the file reference is written into the generated manifest's...

GHSA-4JWF-M4WG-8P66 Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Summary kiota plugin add / kiota plugin generate with -t APIPlugin emits an attacker-controlled statictemplate.file path from the AI-plugin extensions x-ai-adaptive-card, x-ai-capabilities verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest...

EUVD-2026-44935

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...

CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...

PT-2026-60489

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota is an OpenAPI based HTTP Client code generator. The kiota plugin add and kiota plugin generate using the -t APIPlugin flag functions fail to validate paths in static template.file values sourced...