EUVD-2026-44936

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName...

EUVD-2026-44929

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF...

EUVD-2026-44935

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the OpenApiKiotaExtension handling in LanguageInformation and kiota info output. An attacker can make a developer run attacker-controlled shell commands by supplying an OpenAPI document whose x-ms-kiota-info...

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command,...

CVE-2026-59866

Kiota (OpenAPI-based HTTP client generator) is affected by CVE-2026-59866 due to unsafe generation of x-ms-kiota-info clientClassName and clientNamespaceName, which can cause arbitrary file writes and code-injection when kiota generate runs without -c/--class-name. The issue allows attacker-contr...

CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pu...

PT-2026-60491

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to sanitize x-ms-kiota-info clientClassName and clientNamespaceName values when the kiota generate command is executed without the...

PT-2026-60482

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository ...

EUVD-2026-25280

Contour has Lua code injection via Cookie Path Rewrite Policy...

GHSA-VPRM-27PV-JP3W Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting XSS vulnerability via the component /api/core/mod.rs...

CVE-2024-55226

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting XSS vulnerability via the component /api/core/mod.rs...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden version v1.32.5, which stems from the discovery of a cross-site scripting vulnerability via component /api/core/mod.rs...

PT-2025-3103 · Unknown +1 · Vaultwarden +1

Name of the Vulnerable Software and Affected Versions: Vaultwarden versions prior to 1.32.5 Description: An issue in the component src/api/identity.rs of Vaultwarden allows attackers to impersonate users, including Administrators, via a crafted authorization request. This issue enables attackers ...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden versions prior to v1.32.5. An attacker exploiting this vulnerability could execute arbitrary code by injecting a specially...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden versions prior to v1.32.5. An attacker exploiting this vulnerability could impersonate a user via a specially crafted...