Vulnerability-Lookup

GHSA-P5RM-JG5C-8C77

Vulnerability from github – Published: 2026-07-24 16:14 – Updated: 2026-08-17 15:11

Summary

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Details

Impact

Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics static_template (or the adaptive-card extension x-ai-adaptive-card), the file reference is written into the generated manifest's response_semantics.static_template.file and is later resolved by the AI host relative to the plugin package.

An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary (CWE-22 Path Traversal, CWE-829 Inclusion of Functionality from an Untrusted Control Sphere).

A mitigation shipped in v1.32.5 (ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference) rejected literal traversal, rooted paths, drive-qualified paths, and absolute URIs. However, that check inspected the raw reference string, so percent-encoded payloads bypassed every check and were still emitted verbatim. Examples that were incorrectly accepted as safe:

Input	Decodes to
`%2e%2e/card.json`	`../card.json`
`..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd`	`../../../../../../etc/passwd`
`file%3A%2F%2F%2Fetc%2Fpasswd`	`file:///etc/passwd`
`%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd`	`../../../etc/passwd`

Multi-level (double) encoding such as %252e%252e%252fcard.json was also affected. A follow-up review found additional residual bypasses of the same validator: an embedded NUL byte (%00) that truncated the path and defeated the parent-directory segment check, encoding nested deeper than the decode budget (which failed open), and Unicode full-width homoglyphs (e.g. %EF%BC%8E%EF%BC%8E → ．．).

Patches

The percent-encoding bypass is fixed by decoding the reference (bounded multi-pass) before validation: https://github.com/microsoft/kiota/pull/7910
Residual bypasses (NUL / control characters, decode-budget fail-open, Unicode homoglyphs) are fixed by failing closed on residual encoding, rejecting control characters, and NFKC-folding before validation: https://github.com/microsoft/kiota/pull/7913 (tracking issue https://github.com/microsoft/kiota/issues/7912)

Users should upgrade to the first released Microsoft.OpenApi.Kiota version that includes these fixes (the release following 1.33.0).

Workarounds

Only generate clients/plugins from trusted OpenAPI descriptions.
Review generated plugin manifests before deployment and reject any response_semantics.static_template.file value that is not a simple relative path within the adaptiveCards/ package folder (no .., no rooted/absolute paths, no URIs, no percent-encoded separators).

References

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-829: Inclusion of Functionality from an Untrusted Control Sphere
Affected code: src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs (IsSafeFileReference) and enforcement in src/Kiota.Builder/Plugins/PluginsGenerationService.cs.

Severity

6.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.0"
            },
            {
              "fixed": "1.34.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:14:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nKiota generates AI plugin manifests from an OpenAPI description. When the description contains an `x-ai-capabilities` response semantics `static_template` (or the adaptive-card extension `x-ai-adaptive-card`), the `file` reference is written into the generated manifest\u0027s `response_semantics.static_template.file` and is later resolved by the AI host **relative to the plugin package**.\n\nAn attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a `file` reference that resolves **outside** the manifest package (e.g. `../../../../etc/passwd`, an absolute path, or a `file://` / `http(s)://` URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary (CWE-22 Path Traversal, CWE-829 Inclusion of Functionality from an Untrusted Control Sphere).\n\nA mitigation shipped in v1.32.5 (`ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference`) rejected literal traversal, rooted paths, drive-qualified paths, and absolute URIs. However, that check inspected the **raw** reference string, so **percent-encoded** payloads bypassed every check and were still emitted verbatim. Examples that were incorrectly accepted as safe:\n\n| Input | Decodes to |\n|-------|-----------|\n| `%2e%2e/card.json` | `../card.json` |\n| `..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd` | `../../../../../../etc/passwd` |\n| `file%3A%2F%2F%2Fetc%2Fpasswd` | `file:///etc/passwd` |\n| `%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd` | `../../../etc/passwd` |\n\nMulti-level (double) encoding such as `%252e%252e%252fcard.json` was also affected. A follow-up review found additional residual bypasses of the same validator: an embedded NUL byte (`%00`) that truncated the path and defeated the parent-directory segment check, encoding nested deeper than the decode budget (which failed open), and Unicode full-width homoglyphs (e.g. `%EF%BC%8E%EF%BC%8E` \u2192 `\uff0e\uff0e`).\n\n### Patches\n\n- The percent-encoding bypass is fixed by decoding the reference (bounded multi-pass) before validation: https://github.com/microsoft/kiota/pull/7910\n- Residual bypasses (NUL / control characters, decode-budget fail-open, Unicode homoglyphs) are fixed by failing closed on residual encoding, rejecting control characters, and NFKC-folding before validation: https://github.com/microsoft/kiota/pull/7913 (tracking issue https://github.com/microsoft/kiota/issues/7912)\n\nUsers should upgrade to the first released `Microsoft.OpenApi.Kiota` version that includes these fixes (the release following 1.33.0).\n\n### Workarounds\n\n- Only generate clients/plugins from trusted OpenAPI descriptions.\n- Review generated plugin manifests before deployment and reject any `response_semantics.static_template.file` value that is not a simple relative path within the `adaptiveCards/` package folder (no `..`, no rooted/absolute paths, no URIs, no percent-encoded separators).\n\n### References\n\n- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\n- CWE-829: Inclusion of Functionality from an Untrusted Control Sphere\n- Affected code: `src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs` (`IsSafeFileReference`) and enforcement in `src/Kiota.Builder/Plugins/PluginsGenerationService.cs`.",
  "id": "GHSA-p5rm-jg5c-8c77",
  "modified": "2026-08-17T15:11:54Z",
  "published": "2026-07-24T16:14:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/issues/7912"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/pull/7910"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/pull/7913"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/kiota"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)"
}

CVE-2026-73851 (GCVE-0-2026-73851)

Vulnerability from cvelistv5 – Published: 2026-08-17 15:11 – Updated: 2026-08-17 15:26

Title

Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Summary

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 15:26 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M mitre root

References

8 references

URL	Tags
https://github.com/microsoft/kiota/security/advis…	x_refsource_CONFIRM
https://github.com/microsoft/kiota/issues/7912	x_refsource_MISC
https://github.com/microsoft/kiota/pull/7910	x_refsource_MISC
https://github.com/microsoft/kiota/pull/7913	x_refsource_MISC
https://github.com/microsoft/kiota/commit/430008e…	x_refsource_MISC
https://github.com/microsoft/kiota/commit/de3d18d…	x_refsource_MISC
https://github.com/microsoft/kiota/releases/tag/v1.29.1	x_refsource_MISC
https://github.com/microsoft/kiota/releases/tag/v1.34.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
microsoft	kiota	Affected: >= 1.30.0, < 1.34.0 Affected: < 1.29.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T15:26:24.544956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T15:26:40.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kiota",
          "vendor": "microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.30.0, \u003c 1.34.0"
            },
            {
              "status": "affected",
              "version": "\u003c 1.29.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T15:11:39.724Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"
        },
        {
          "name": "https://github.com/microsoft/kiota/issues/7912",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/issues/7912"
        },
        {
          "name": "https://github.com/microsoft/kiota/pull/7910",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/pull/7910"
        },
        {
          "name": "https://github.com/microsoft/kiota/pull/7913",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/pull/7913"
        },
        {
          "name": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"
        },
        {
          "name": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"
        },
        {
          "name": "https://github.com/microsoft/kiota/releases/tag/v1.29.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1"
        },
        {
          "name": "https://github.com/microsoft/kiota/releases/tag/v1.34.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p5rm-jg5c-8c77",
        "discovery": "UNKNOWN"
      },
      "title": "Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73851",
    "datePublished": "2026-08-17T15:11:39.724Z",
    "dateReserved": "2026-08-13T17:44:28.644Z",
    "dateUpdated": "2026-08-17T15:26:40.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-P5RM-JG5C-8C77

Impact

Patches

Workarounds

References

CVE-2026-73851 (GCVE-0-2026-73851)

Tags

Sightings

Nomenclature

Related by attack behaviour