{"vulnerability": "cve-2026-5986", "sightings": [{"uuid": "b4ffafdc-2fd9-451a-89cb-498992109cb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59868", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqde5mvdyk2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59868 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 js-yaml: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/01190CF5-90D6-4027-8FEF-5E7B5D4DEEC2", "creation_timestamp": "2026-07-10T23:59:16.539236Z"}, {"uuid": "55cf1d8a-dab7-462a-87a9-29e24c831874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdej46erx2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59869 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 js-yaml: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/E75C9B8D-BEBC-4287-A4F8-0AEAA0E029A7", "creation_timestamp": "2026-07-11T00:05:41.451969Z"}, {"uuid": "eac54817-ca83-4cd9-a8b9-5484ec5f0b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59869", "type": "seen", "source": "https://gist.github.com/djlan/23e14d920ebf2e85114f85d06bd290e6", "content": "# PR \u89e3\u91ca: [SECURITY] bump js-yaml from 4.1.0 to 4.3.0\n\n\u672c\u6b21\u53d8\u66f4\u901a\u8fc7\u5347\u7ea7 YAML \u89e3\u6790\u4f9d\u8d56\u4fee\u590d\u9ad8\u5371\u5b89\u5168\u6f0f\u6d1e\uff0c\u540c\u65f6\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u4ee5\u56fa\u5b9a\u65b0\u7684\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\u3002\n\n**PR \u94fe\u63a5**: https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2212461\n**\u4f5c\u8005**: Dependabot\n**\u72b6\u6001**: completed\n**\u5206\u652f**: `dependabot/npm_and_yarn/js-yaml-4.3.0-3691286` \u2192 `main`\n**\u53d8\u66f4\u7edf\u8ba1**: 2 files changed, +181/-193 lines\n\n## \u76ee\u5f55\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n\n---\n\n## \u53d8\u66f4\u6982\u89c8\n\n### 1. Desktop \u6269\u5c55\u4f9d\u8d56\u5b89\u5168\u5347\u7ea7\n\n**\u76ee\u7684**: \u5c06 Desktop \u6269\u5c55\u76f4\u63a5\u4f9d\u8d56\u7684 `js-yaml` \u4ece 4.1.0 \u5347\u7ea7\u5230 4.3.0\uff0c\u4ee5\u4fee\u590d Component Governance \u6807\u8bb0\u7684\u9ad8\u5371\u6f0f\u6d1e CVE-2026-59869\u3002\u65b0\u7248\u672c\u4e3a YAML \u5408\u5e76\u952e\u5904\u7406\u589e\u52a0\u603b\u91cf\u9650\u5236\uff0c\u964d\u4f4e\u6076\u610f YAML \u901a\u8fc7\u5927\u91cf `<<` \u5408\u5e76\u952e\u6d88\u8017\u8fc7\u591a\u8ba1\u7b97\u8d44\u6e90\u7684\u98ce\u9669\u3002\n\n**\u6d89\u53ca\u6587\u4ef6**:\n- [extensions/desktop/package.json](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2212461?path=/extensions/desktop/package.json&_a=files) \u2014 \u5c06 Desktop \u6269\u5c55\u7684 `js-yaml` \u7248\u672c\u8303\u56f4\u7531 `^4.1.0` \u66f4\u65b0\u4e3a `^4.3.0`\n\n**\u5173\u952e\u53d8\u66f4**:\n1. **\u5f15\u5165\u5b89\u5168\u9632\u62a4\u7248\u672c**: `js-yaml` 4.3.0 \u56de\u79fb\u4e86 `maxTotalMergeKeys` \u52a0\u8f7d\u9009\u9879\uff0c\u5e76\u4ee5\u9ed8\u8ba4\u4e0a\u9650\u9650\u5236\u4e00\u6b21 `load()` \u6216 `loadAll()` \u8c03\u7528\u4e2d\u5904\u7406\u7684 YAML \u5408\u5e76\u952e\u603b\u6570\uff0c\u4ece\u6839\u56e0\u4e0a\u7ea6\u675f\u5f02\u5e38\u8f93\u5165\u9020\u6210\u7684\u8d44\u6e90\u6d88\u8017\u3002\n2. **\u4fdd\u6301\u4e3b\u7248\u672c\u517c\u5bb9\u6027**: \u5347\u7ea7\u4ecd\u4f4d\u4e8e 4.x \u4e3b\u7248\u672c\u5185\uff0c\u6ca1\u6709\u8fc1\u79fb\u5230\u5305\u542b\u66f4\u591a\u7834\u574f\u6027\u8c03\u6574\u7684 5.x\uff0c\u56e0\u6b64\u73b0\u6709\u5bfc\u5165\u65b9\u5f0f\u548c\u5e38\u7528\u89e3\u6790\u63a5\u53e3\u9884\u8ba1\u4fdd\u6301\u517c\u5bb9\u3002\n3. **\u8986\u76d6\u95f4\u63a5\u4f7f\u7528\u573a\u666f**: \u9664\u5e94\u7528\u76f4\u63a5\u8c03\u7528\u5916\uff0c\u4f9d\u8d56\u94fe\u4e2d\u7684 ESLint\u3001Cosmiconfig\u3001Mocha \u548c\u914d\u7f6e\u52a0\u8f7d\u5de5\u5177\u4e5f\u4f1a\u89e3\u6790 YAML\uff1b\u9501\u5b9a\u5230\u4fee\u590d\u7248\u672c\u6709\u52a9\u4e8e\u51cf\u5c11\u8fd9\u4e9b\u5de5\u5177\u94fe\u8def\u5f84\u66b4\u9732\u4e8e\u540c\u7c7b\u6076\u610f\u8f93\u5165\u7684\u53ef\u80fd\u6027\u3002\n\n[\u2191 \u8fd4\u56de\u76ee\u5f55](#\u76ee\u5f55)\n\n---\n\n### 2. pnpm \u4f9d\u8d56\u56fe\u4e0e\u9501\u6587\u4ef6\u540c\u6b65\n\n**\u76ee\u7684**: \u8ba9\u53ef\u590d\u73b0\u5b89\u88c5\u7ed3\u679c\u4e0e\u65b0\u7684\u4f9d\u8d56\u58f0\u660e\u4e00\u81f4\uff0c\u5e76\u5c06\u4f9d\u8d56\u56fe\u4e2d\u53ef\u66f4\u65b0\u7684 `js-yaml` 3.x\u30014.x\u5b9e\u4f8b\u5206\u522b\u89e3\u6790\u5230\u5305\u542b\u5b89\u5168\u4fee\u590d\u7684 3.15.0 \u548c 4.3.0\u3002\n\n**\u6d89\u53ca\u6587\u4ef6**:\n- [pnpm-lock.yaml](https://dev.azure.com/msdata/A365/_git/vscode-trident/pullrequest/2212461?path=/pnpm-lock.yaml&_a=files) \u2014 \u66f4\u65b0 `js-yaml` \u89e3\u6790\u7248\u672c\u3001\u4f9d\u8d56\u5feb\u7167\u3001peer dependency \u8868\u8fbe\u53ca\u5927\u91cf\u5305\u5b8c\u6574\u6027\u54c8\u5e0c\n\n**\u5173\u952e\u53d8\u66f4**:\n1. **\u9501\u5b9a\u4fee\u590d\u7248\u672c**: Desktop importer \u7684 `js-yaml` specifier \u548c\u5b9e\u9645\u7248\u672c\u540c\u6b65\u66f4\u65b0\u5230 4.3.0\uff1b\u4f9d\u8d56\u56fe\u4e2d\u7684 4.1.0 \u5f15\u7528\u968f\u4e4b\u8fc1\u79fb\u5230 4.3.0\u3002\n2. **\u540c\u6b65\u65e7\u4e3b\u7248\u672c\u5206\u652f**: \u7531 Changesets\u3001Istanbul\u3001Textlint \u548c YAML \u6587\u4ef6\u8bfb\u53d6\u5de5\u5177\u95f4\u63a5\u4f7f\u7528\u7684 `js-yaml` 3.14.1 \u66f4\u65b0\u5230 3.15.0\uff0c\u4f7f\u4ecd\u53d7 3.x \u517c\u5bb9\u7ea6\u675f\u7684\u5de5\u5177\u4e5f\u83b7\u5f97\u5bf9\u5e94\u7684\u5b89\u5168\u4fee\u590d\u3002\n3. **\u91cd\u65b0\u89c4\u8303 peer dependency \u5feb\u7167**: \u591a\u4e2a Webpack loader/plugin \u5feb\u7167\u79fb\u9664\u4e86\u5d4c\u5957\u7684 `webpack-cli` \u4e0a\u4e0b\u6587\uff0c\u5408\u5e76\u4e86\u5185\u5bb9\u7b49\u4ef7\u7684\u91cd\u590d\u5feb\u7167\u3002\u8fd9\u4e3b\u8981\u662f pnpm \u91cd\u65b0\u89e3\u6790\u9501\u6587\u4ef6\u7684\u7ed3\u679c\uff0c\u800c\u975e\u8fd9\u4e9b\u6784\u5efa\u4f9d\u8d56\u672c\u8eab\u53d1\u751f\u7248\u672c\u5347\u7ea7\u3002\n4. **\u66f4\u65b0\u5e73\u53f0\u5305\u5143\u6570\u636e**: Rollup \u5e73\u53f0\u4e8c\u8fdb\u5236\u5305\u8865\u5145\u4e86 `glibc` \u6216 `musl` \u6761\u4ef6\uff0c\u6709\u52a9\u4e8e pnpm \u5728 Linux \u73af\u5883\u9009\u62e9\u6b63\u786e\u7684\u539f\u751f\u5305\uff0c\u4f46\u4e5f\u6269\u5927\u4e86\u672c\u6b21\u5b89\u5168\u5347\u7ea7\u4e4b\u5916\u7684\u9501\u6587\u4ef6\u53d8\u66f4\u9762\u3002\n\n[\u2191 \u8fd4\u56de\u76ee\u5f55](#\u76ee\u5f55)\n\n---\n\n## \u5f71\u54cd\u5206\u6790\n\n- **\u5f71\u54cd\u8303\u56f4**: \u4e3b\u8981\u5f71\u54cd Desktop \u6269\u5c55\u53ca\u4ed3\u5e93\u5185\u901a\u8fc7\u5171\u4eab pnpm \u9501\u6587\u4ef6\u5b89\u88c5\u7684\u5f00\u53d1\u3001\u6784\u5efa\u3001Lint\u3001\u6d4b\u8bd5\u548c\u914d\u7f6e\u52a0\u8f7d\u6d41\u7a0b\uff1b\u6ca1\u6709\u4e1a\u52a1\u6e90\u7801\u3001\u754c\u9762\u6216\u516c\u5f00 API \u7684\u76f4\u63a5\u4fee\u6539\u3002\n- **\u7528\u6237\u611f\u77e5**: \u6b63\u5e38 YAML \u8f93\u5165\u7684\u89e3\u6790\u7ed3\u679c\u9884\u8ba1\u4e0d\u53d8\u3002\u5bf9\u4e8e\u5305\u542b\u6781\u5927\u91cf\u5408\u5e76\u952e\u7684\u5f02\u5e38\u6216\u6076\u610f YAML\uff0c\u65b0\u7248\u672c\u53ef\u80fd\u66f4\u65e9\u62d2\u7edd\u89e3\u6790\u6216\u629b\u51fa\u9650\u5236\u9519\u8bef\uff0c\u8fd9\u662f\u9884\u671f\u7684\u5b89\u5168\u884c\u4e3a\u3002\n- **\u98ce\u9669\u70b9**:\n  1. **\u9501\u6587\u4ef6\u53d8\u66f4\u9762\u504f\u5927**: \u6838\u5fc3\u9700\u6c42\u53ea\u662f\u5347\u7ea7 `js-yaml`\uff0c\u4f46\u9501\u6587\u4ef6\u540c\u65f6\u91cd\u5199\u4e86\u5927\u91cf Webpack peer \u5feb\u7167\u3001\u5e73\u53f0\u5305\u5143\u6570\u636e\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\uff1b\u82e5\u4e0d\u540c pnpm \u6216 registry \u914d\u7f6e\u53c2\u4e0e\u751f\u6210\uff0c\u53ef\u80fd\u9020\u6210\u8de8\u73af\u5883\u5b89\u88c5\u7ed3\u679c\u5dee\u5f02\u3002\n  2. **\u5b8c\u6574\u6027\u54c8\u5e0c\u964d\u7ea7\u73b0\u8c61**: \u591a\u4e2a\u672a\u5347\u7ea7\u7684\u8f6f\u4ef6\u5305\u7531 `sha512` \u5b8c\u6574\u6027\u503c\u6539\u5199\u4e3a `sha1`\u3002\u8fd9\u4e0d\u7b49\u540c\u4e8e\u5305\u5185\u5bb9\u53d1\u751f\u53d8\u5316\uff0c\u4f46 SHA-1 \u7684\u6297\u78b0\u649e\u80fd\u529b\u66f4\u5f31\uff0c\u5e94\u786e\u8ba4\u8fd9\u662f\u53d7\u4fe1\u4efb registry \u8fd4\u56de\u7684\u9884\u671f\u5143\u6570\u636e\uff0c\u800c\u4e0d\u662f\u955c\u50cf\u6216\u5305\u7ba1\u7406\u914d\u7f6e\u5f02\u5e38\u3002\n  3. **\u89e3\u6790\u9650\u5236\u5e26\u6765\u7684\u884c\u4e3a\u53d8\u5316**: \u65b0\u589e\u7684\u5408\u5e76\u952e\u603b\u91cf\u4e0a\u9650\u53ef\u80fd\u4f7f\u6b64\u524d\u80fd\u591f\u5b8c\u6210\u3001\u4f46\u7ed3\u6784\u6781\u7aef\u590d\u6742\u7684\u5408\u6cd5 YAML \u5931\u8d25\uff1b\u5982\u679c\u4ea7\u54c1\u4f1a\u5904\u7406\u5927\u578b\u7528\u6237 YAML\uff0c\u9700\u8981\u5173\u6ce8\u9519\u8bef\u5448\u73b0\u548c\u517c\u5bb9\u6027\u3002\n  4. **\u95f4\u63a5\u4f9d\u8d56\u8054\u52a8**: `js-yaml` 3.x \u548c 4.x \u7684\u591a\u4e2a\u5feb\u7167\u540c\u65f6\u5347\u7ea7\uff0c\u53ef\u80fd\u5f71\u54cd ESLint\u3001Mocha\u3001Cosmiconfig\u3001Changesets \u7b49\u5de5\u5177\u8bfb\u53d6\u914d\u7f6e\u7684\u8fb9\u7f18\u884c\u4e3a\uff0c\u5c24\u5176\u662f\u590d\u6742\u951a\u70b9\u3001\u522b\u540d\u548c\u5408\u5e76\u952e\u573a\u666f\u3002\n  5. **\u65e0\u8c03\u8bd5\u4ee3\u7801\u6216\u786c\u7f16\u7801\u4e1a\u52a1\u503c**: \u672c\u6b21\u6ca1\u6709\u65b0\u589e\u65e5\u5fd7\u3001\u8c03\u8bd5\u5f00\u5173\u6216\u4e1a\u52a1\u5e38\u91cf\uff1b\u7248\u672c\u53f7\u548c\u5b89\u5168\u9650\u5236\u6765\u81ea\u4f9d\u8d56\u58f0\u660e\u53ca\u4e0a\u6e38\u5e93\u9ed8\u8ba4\u503c\uff0c\u4e0d\u5c5e\u4e8e\u5e94\u7528\u5c42\u786c\u7f16\u7801\u3002\n  6. **\u65e0\u5df2\u77e5\u7834\u574f\u6027\u4e3b\u7248\u672c\u5347\u7ea7**: \u76f4\u63a5\u4f9d\u8d56\u4fdd\u6301\u5728 4.x\uff0c\u672a\u5f15\u5165 `js-yaml` 5.x \u4e2d\u7684 API \u548c\u8bed\u4e49\u7834\u574f\u6027\u53d8\u5316\uff1b\u4e3b\u8981\u517c\u5bb9\u98ce\u9669\u6765\u81ea\u5b89\u5168\u9650\u5236\u6536\u7d27\uff0c\u800c\u4e0d\u662f\u516c\u5f00 API \u5220\u9664\u3002\n", "creation_timestamp": "2026-08-07T16:40:00.679111Z"}, {"uuid": "ffc28fdd-b89c-46da-9c61-e9e6f474006a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59866", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrluxqhxd2c", "content": "CVE-2026-59866 - Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName\nCVE ID : CVE-2026-59866\n \n Published : July 16, 2026, 2:46 p.m. | 48\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Pri...", "creation_timestamp": "2026-07-16T15:54:52.254509Z"}, {"uuid": "4d62ba01-cc3f-471e-8371-3550fa70cb78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59864", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrlwrdoo42s", "content": "CVE-2026-59864 - Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions\nCVE ID : CVE-2026-59864\n \n Published : July 16, 2026, 2:45 p.m. | 49\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kio...", "creation_timestamp": "2026-07-16T15:55:52.532585Z"}, {"uuid": "6b07b4be-456d-4405-aec7-65cf365e2927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59865", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrm6qrdhu2u", "content": "CVE-2026-59865 - Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`\nCVE ID : CVE-2026-59865\n \n Published : July 16, 2026, 2:43 p.m. | 51\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32...", "creation_timestamp": "2026-07-16T16:00:20.475199Z"}, {"uuid": "dabf37c1-8929-4d55-b0c9-702c22cae2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59867", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmi4ohjs22", "content": "CVE-2026-59867 - Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref\nCVE ID : CVE-2026-59867\n \n Published : July 16, 2026, 2:48 p.m. | 47\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resol...", "creation_timestamp": "2026-07-16T16:05:34.844425Z"}, {"uuid": "f0385219-52ac-40a6-8a65-ef8c1b2add7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59860", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmthsmaf2l", "content": "CVE-2026-59860 - Kiota: XML Doc-Comment Newline Breakout Code Injection\nCVE ID : CVE-2026-59860\n \n Published : July 16, 2026, 3:16 p.m. | 18\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.3, Kiota is affected by a code-generati...", "creation_timestamp": "2026-07-16T16:11:55.587474Z"}, {"uuid": "22574a50-892a-411c-a20f-31937b4b55c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59861", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqro4qey2p2h", "content": "CVE-2026-59861 - Kiota: Code Generation Literal Injection in Kiota Ruby Generator\nCVE ID : CVE-2026-59861\n \n Published : July 16, 2026, 3:16 p.m. | 18\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator emb...", "creation_timestamp": "2026-07-16T16:35:01.239418Z"}, {"uuid": "1ab54a6e-59e4-46ce-b598-d8c13e6df8cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59862", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrofozyab2n", "content": "CVE-2026-59862 - Kiota: Code Generation Literal Injection in the Python Generator\nCVE ID : CVE-2026-59862\n \n Published : July 16, 2026, 3:16 p.m. | 18\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator l...", "creation_timestamp": "2026-07-16T16:40:00.925648Z"}, {"uuid": "ff2103df-f943-44ee-a294-aa4181d2038b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59864", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqrojfdglg2c", "content": "CVE-2026-59864 - kiota\nKiota, a tool that generates HTTP client code, had a flaw that could allow attackers to inject malicious paths into plugin manifests. This could lead to security issues when the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#kiota #microsoft #CVE #infosec", "creation_timestamp": "2026-07-16T16:42:08.798029Z"}, {"uuid": "6a95f911-05b2-4c05-a834-33c2f1029312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59863", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqroonmn3q2m", "content": "CVE-2026-59863 - Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF\nCVE ID : CVE-2026-59863\n \n Published : July 16, 2026, 3:16 p.m. | 18\u00a0minutes ago\n \n Description : Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota hono...", "creation_timestamp": "2026-07-16T16:45:01.375471Z"}, {"uuid": "3acaee8b-a1dc-4528-a7ff-f455fd725c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59865", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqrou5lqyq2o", "content": "CVE-2026-59865 - kiota\nThe Kiota tool can execute malicious commands when generating install instructions for dependencies. This happened when Kiota read and executed commands from compromised or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#kiota #microsoft #CVE #infosec", "creation_timestamp": "2026-07-16T16:48:05.831505Z"}, {"uuid": "a2b223fc-7dd0-42d4-a77b-12589e81dcae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59866", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqroxp5a7c2p", "content": "CVE-2026-59866 - kiota\nKiota, a tool that generates code from OpenAPI descriptions, had a security issue that could allow an attacker to write files and inject malicious code into the generated code. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#kiota #microsoft #CVE #infosec", "creation_timestamp": "2026-07-16T16:50:14.902495Z"}, {"uuid": "04d25bdf-56ef-41ce-be90-9cd41d31e0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59869", "type": "published-proof-of-concept", "source": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m", "content": "", "creation_timestamp": "2026-07-20T22:37:28.700571Z"}, {"uuid": "b224eb4b-5efe-4daa-940a-e24511df2eb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59868", "type": "published-proof-of-concept", "source": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv", "content": "", "creation_timestamp": "2026-07-20T22:37:26.484515Z"}, {"uuid": "6eb7e480-9b54-4fbe-93c8-9734dd1dbff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59860", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrftsuervb2e", "content": "CVE-2026-59860 - kiota\nKiota's code generator can inject malicious code into C# clients if an attacker inserts newline characters into an OpenAPI description. This can happen when an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#kiota #microsoft #dotnet #CVE #infosec", "creation_timestamp": "2026-07-24T17:10:06.172417Z"}]}