Microsoft
Microsoft Kiota: vulnerabilidades y CVE
Microsoft Kiota tiene 12 vulnerabilidades publicadas, 12 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses12
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-73851 | Media (6.1) | 2.3% | — | 17 ago 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the… |
| CVE-2026-59867 | Alta (7.1) | 2.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota… |
| CVE-2026-59866 | Crítica (9.3) | 1.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated… |
| CVE-2026-59865 | Crítica (9.3) | 4.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from… |
| CVE-2026-59864 | Crítica (9.3) | 1.3% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from… |
| CVE-2026-59863 | Alta (7) | 1.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values… |
| CVE-2026-59862 | Alta (7.5) | 1.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through… |
| CVE-2026-59861 | Alta (7.5) | 2.0% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and… |
| CVE-2026-59860 | Alta (8.7) | 1.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs… |
| CVE-2026-59859 | Alta (8.7) | 1.4% | — | 16 jul 2026 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP… |
| CVE-2026-44503 | Alta (7) | 0.84% | — | 14 may 2026 | The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different… |
| CVE-2026-41134 | Alta (7.3) | 0.35% | — | 22 abr 2026 | Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example:… |