FixVibe
Covered by FixVibecritical

Microsoft Kiota Command Injection via Malicious OpenAPI Metadata (CVE-2026-59865)

Microsoft Kiota releases before 1.32.5 could trust dependency-install guidance supplied by an OpenAPI description. Exploitation requires an untrusted or compromised description and a developer or integration that follows the supplied install action. Kiota 1.32.5 removes support for description-supplied dependency install commands, and FixVibe now reports affected repository-managed Kiota versions as a version-based advisory.

CVE-2026-59865GHSA-hq9q-27g5-qwpjCWE-94CWE-829

Microsoft Kiota generates API clients from OpenAPI descriptions. CVE-2026-59865 affects Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder releases before 1.32.5 [S1][S2].

Impact

An untrusted or compromised OpenAPI description could supply dependency-install guidance to an affected Kiota workflow. If a developer or an integration then follows that action, commands could run in a developer or CI environment that may hold source code and credentials [S1][S2]. Repository version evidence does not establish that these exploitation conditions occurred.

Root cause

Affected Kiota releases trusted a description-supplied dependencyInstallCommand when presenting dependency installation information. The affected workflows included manual use and the Kiota VS Code integration. Version 1.32.5 removed support for dependency install commands supplied by API descriptions [S1][S4].

How FixVibe covers it

FixVibe GitHub repo scans flag affected Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder declarations in repository-managed .NET tool and NuGet dependency files. Findings show the affected package evidence, advisory identifiers, and the fixed version so teams can patch the developer and CI tooling that the repository controls.

This is a version-based advisory. FixVibe does not parse command strings, run Kiota, trigger IDE install actions, execute suggested commands, inspect developer workstations or globally installed tools, or claim that an untrusted description was processed or that a workstation was compromised.

Remediation

Upgrade every active Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder installation to 1.32.5 or newer [S1][S2][S3]. Restore tools and packages, regenerate lockfiles, rebuild generator containers and CI images, and update downloaded Kiota binaries and the Kiota VS Code extension where applicable. Review the provenance of external OpenAPI descriptions before code-generation or dependency-install actions.

Sources

  • Microsoft Kiota security advisory [S1]
  • GitHub reviewed advisory [S2]
  • NVD CVE record [S3]
  • Microsoft Kiota 1.32.5 release [S4]
Microsoft Kiota Command Injection via Malicious OpenAPI Metadata (CVE-2026-59865) — FixVibe research · FixVibe