🚨Critical - Three Microsoft Kiota flaws from untrusted OpenAPI specs (CVE-2026-59864 / 59865 / 59866) Microsoft Kiota, the OpenAPI-based client and Copilot/Teams plugin generator, has three critical vulnerabilities before 1.32.5, all rooted in trusting attacker-controlled fields in an OpenAPI or plugin description (CVSS 9.3 each). - CVE-2026-59866: unsanitized clientClassName / clientNamespaceName during kiota generate enable path traversal outside the output directory and code injection into generated class/namespace declarations. - CVE-2026-59865: kiota info presents a spec-supplied dependencyInstallCommand as its recommended install command, leading to command injection when run. - CVE-2026-59864: kiota plugin add/generate write attacker-controlled static_template.file paths into Copilot/Teams manifests without validation, allowing path traversal / out-of-package file inclusion. All are triggered by running Kiota against a malicious OpenAPI/plugin description. Three separate bugs, one fix. 👉Upgrade Microsoft Kiota to 1.32.5 or later.
Post summary
Microsoft Kiota 1.32.5 or newer includes a fix for three critical vulnerabilities (CVE‑2026‑59864/65/66) that allow path traversal, command injection, and code injection via malicious OpenAPI/plugin specs.