CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.

### Summary Microsoft Kiota honors a poisoned `.kiota/workspace.json` — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — **unvalidated** on `kiota client generate` / `kiota plugin generate`. A repository (or pull request) containing a malicious per-client / per-plugin `outputPath` causes Kiota, when a developer or CI runs the documented regenerate command, to **(CWE-22) write the entire generated client to an arbitrary path outside the workspace** — the `outputPath` was not confined to the workspace root and absolute paths were accepted. Confirmed on Kiota **1.32.4** (`KIOTA_CONFIG_PREVIEW=true`, the self-contained `linux-x64` release binary). ### Details ```jsonc // .kiota/workspace.json (committed to the repo) "clients": { "MyClient": { "outputPath": "/abs/path/outside/repo/pwned_client" // -> generated client written here (CWE-22) }} ``` Running `kiota client generate --client-name MyClient` in the repo writes `MyClient.cs`, `P/PRequestBuilder.cs`, … to the attacker-chosen `outputPath` (verified outside the working tree). #### Note on `descriptionLocation` The per-consumer `descriptionLocation` is intentionally fetched at generation time — this is how Kiota knows where to pull an updated description from when refreshing a client, the same way any other value in a committed lock/config file is honored. It is **not** treated as a vulnerability and is unchanged; only `outputPath` is now confined. ### Impact A malicious or compromised repository — or a malicious PR that edits `.kiota/workspace.json` — leads to arbitrary file write on the developer's or CI host's filesystem (overwrite source/build files, drop files in auto-loaded locations) whenever a teammate clones/pulls and runs the documented `kiota client generate` / `kiota plugin generate` to refresh the client. CWE-22. This is a different trust boundary from the OpenAPI-description-based findings: the malicious input is the Kiota **config**, not the spec. ### Patches Fixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7885). On loading a workspace configuration, each client/plugin `outputPath` is validated to be a relative subdirectory of the workspace: null/empty, rooted paths (POSIX `/`, UNC `\\` / `//`, Windows drive `X:\`), and any `..` traversal segment are rejected, and the resolved full path must stay under the workspace root. Generation aborts with an error if any consumer's `outputPath` escapes the workspace. ### Remediation Upgrade to Kiota **1.29.1, 1.32.5** or later. Review any committed workspace configs for `outputPath` values that point outside the workspace.

### Summary Microsoft Kiota honors a poisoned `.kiota/workspace.json` — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — **unvalidated** on `kiota client generate` / `kiota plugin generate`. A repository (or pull request) containing a malicious per-client / per-plugin `outputPath` causes Kiota, when a developer or CI runs the documented regenerate command, to **(CWE-22) write the entire generated client to an arbitrary path outside the workspace** — the `outputPath` was not confined to the workspace root and absolute paths were accepted. Confirmed on Kiota **1.32.4** (`KIOTA_CONFIG_PREVIEW=true`, the self-contained `linux-x64` release binary). ### Details ```jsonc // .kiota/workspace.json (committed to the repo) "clients": { "MyClient": { "outputPath": "/abs/path/outside/repo/pwned_client" // -> generated client written here (CWE-22) }} ``` Running `kiota client generate --client-name MyClient` in the repo writes `MyClient.cs`, `P/PRequestBuilder.cs`, … to the attacker-chosen `outputPath` (verified outside the working tree). #### Note on `descriptionLocation` The per-consumer `descriptionLocation` is intentionally fetched at generation time — this is how Kiota knows where to pull an updated description from when refreshing a client, the same way any other value in a committed lock/config file is honored. It is **not** treated as a vulnerability and is unchanged; only `outputPath` is now confined. ### Impact A malicious or compromised repository — or a malicious PR that edits `.kiota/workspace.json` — leads to arbitrary file write on the developer's or CI host's filesystem (overwrite source/build files, drop files in auto-loaded locations) whenever a teammate clones/pulls and runs the documented `kiota client generate` / `kiota plugin generate` to refresh the client. CWE-22. This is a different trust boundary from the OpenAPI-description-based findings: the malicious input is the Kiota **config**, not the spec. ### Patches Fixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7885). On loading a workspace configuration, each client/plugin `outputPath` is validated to be a relative subdirectory of the workspace: null/empty, rooted paths (POSIX `/`, UNC `\\` / `//`, Windows drive `X:\`), and any `..` traversal segment are rejected, and the resolved full path must stay under the workspace root. Generation aborts with an error if any consumer's `outputPath` escapes the workspace. ### Remediation Upgrade to Kiota **1.29.1, 1.32.5** or later. Review any committed workspace configs for `outputPath` values that point outside the workspace.

Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.5, Kiota respetaba una configuración de espacio de trabajo .kiota/workspace.json envenenada sin validar los valores de outputPath por cliente o por plugin durante kiota client generate y kiota plugin generate, permitiendo que un repositorio malicioso o una solicitud de extracción utilizara rutas absolutas, rutas POSIX / con raíz, rutas UNC \\ o //, rutas de unidad de Windows X:\, o segmentos de recorrido .. para escribir archivos de cliente generados fuera de la raíz del espacio de trabajo en un host de desarrollador o CI. Este problema está solucionado en la versión 1.32.5.