—0.0NuGet
GHSA-2hx3-vp6r-mg3f· CVE-2026-41134Kiota: Code Generation Literal Injection
Modified: 8/17/2026
package
NuGet/Microsoft.OpenApi.Kiota.Builder
pkg:nuget/Microsoft.OpenApi.Kiota.Builder
HIGHNuGet
GHSA-3hrf-2gc2-mx32· CVE-2026-59860Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Modified: 8/17/2026
CRITICALNuGet
GHSA-4jwf-m4wg-8p66· CVE-2026-59864Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Modified: 8/17/2026
HIGHNuGet
GHSA-4rj6-vrwv-wr8m· CVE-2026-59863Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Modified: 8/17/2026
HIGHNuGet
GHSA-4vv7-jj25-4gh6· CVE-2026-59866Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Modified: 8/17/2026
HIGH7.5NuGet
GHSA-7f3j-j7jj-r3vr· CVE-2026-59862Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
Modified: 8/17/2026
CRITICALNuGet
GHSA-hq9q-27g5-qwpj· CVE-2026-59865Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Modified: 8/17/2026
HIGHNuGet
GHSA-jqwh-526h-c92j· CVE-2026-59859Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
Modified: 8/17/2026
HIGH7.1NuGet
GHSA-rg4h-fpcp-2qm8· CVE-2026-59867Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Modified: 8/17/2026
HIGH7.5NuGet
GHSA-xg2h-5xr2-29jw· CVE-2026-59861Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Modified: 8/17/2026