CVE-2026-59863

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5

Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository or pull request to specify absolute paths, rooted POSIX / paths, UNC `` or // paths, Windows drive X: paths, or directory traversal .. segments. Consequently, generated client files can be written outside the intended workspace root on a developer's machine or a CI host.

Recommendations Update Kiota to version 1.32.5.