Microsoft Microsoft.Openapi.Kiota vulnerabilities
2 known vulnerabilities affecting microsoft/microsoft.openapi.kiota.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1LOW1
Vulnerabilities
Page 1 of 1
CVE-2026-105796P3HIGHCVSS 8.8v>= 0.5.0, < 1.35.02026-10-06
CVE-2026-105796 [HIGH] CWE-94 CVE-2026-105796: Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java saniti
ghsanvd
CVE-2026-105795P4LOWCVSS 3.1v>= 1.25.1, < 1.35.02026-10-06
CVE-2026-105795 [LOW] CWE-22 CVE-2026-105795: Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-ca
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, ro
ghsanvd