CVE-2026-73851

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions prior to 1.34.0

Description Kiota is an OpenAPI based HTTP Client code generator. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package, such as absolute paths, file:// or http(s):// URIs, or path traversal sequences like ../../../../etc/passwd. This occurs when the description contains an x-ai-capabilities response semantics static template or the x-ai-adaptive-card extension, causing the file reference to be written into the generated manifest's response semantics.static template.file. When the manifest is deployed and consumed by an AI host, it can lead to the inclusion or disclosure of files outside the intended package boundary. A previous mitigation in version 1.32.5 was bypassed using percent-encoded payloads, double encoding, embedded NUL bytes (%00), or Unicode full-width homoglyphs, as the validator inspected the raw reference string instead of the decoded value.

Recommendations Update Kiota to version 1.29.1 or later. Update Kiota to version 1.34.0 or later. Only generate clients or plugins from trusted OpenAPI descriptions. Review generated plugin manifests before deployment and reject any response semantics.static template.file value that is not a simple relative path within the adaptiveCards/ package folder.