microsoft kiota vulnerabilities
13 published CVEs name microsoft kiota among the affected products.
- 13Published CVEs13 of them scored
- 13Last 12 monthspublished in the last year
- 3Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
microsoft · kiota
High8.8 - CVE-2026-105795
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
microsoft · kiota
Low3.1 - CVE-2026-73851
Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
microsoft · kiota
Medium6.1 - CVE-2026-59867
Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
microsoft · kiota
High7.1 - CVE-2026-59866
Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
microsoft · kiota
Critical9.3 - CVE-2026-59864
Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
microsoft · kiota
Critical9.3 - CVE-2026-59865
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
microsoft · kiota
Critical9.3 - CVE-2026-59863
Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
microsoft · kiota
High7.0 - CVE-2026-59859
Kiota: Code Generation Literal Injection in the PHP Generator
microsoft · kiota
High8.7 - CVE-2026-59862
Kiota: Code Generation Literal Injection in the Python Generator
microsoft · kiota
High7.5