Kiota (Microsoft) - vulnerabilities (CVEs)
13 CVEs, 2 in the last 30 days, 99 known versions, newest CVE from 2026-10-06. Vendor: Microsoft.
CVEs of Kiota
- CVE-2026-105796 - CVSS 8.8 (high), 2026-10-06: Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment…
- CVE-2026-105795 - CVSS 3.1 (low), 2026-10-06: Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an…
- CVE-2026-73851 - CVSS 6.1 (medium), 2026-08-17: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by…
- CVE-2026-59867 - CVSS 7.1 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and…
- CVE-2026-59866 - CVSS 9.3 (critical), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values…
- CVE-2026-59864 - CVSS 9.3 (critical), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted…
- CVE-2026-59865 - CVSS 9.3 (critical), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read…
- CVE-2026-59863 - CVSS 7 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration…
- CVE-2026-59859 - CVSS 8.7 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property…
- CVE-2026-59862 - CVSS 7.5 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions…
- CVE-2026-59861 - CVSS 7.5 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and…
- CVE-2026-59860 - CVSS 8.7 (high), 2026-07-16: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML…
- CVE-2026-41134 - CVSS 7.8 (high), 2026-04-22: Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in…
