Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.

Source published

16 Jul 2026 14:46:50 UTC

Source modified

17 Aug 2026 15:03:20 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.

Source published

16 Jul 2026 16:19:15 UTC

Source modified

24 Oct 2026 20:10:00 UTC

Observed here

25 Oct 2026 14:19:22 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary Microsoft Kiota emitted the `x-ms-kiota-info` extension's `clientClassName` or `clientNamespaceName` value **raw**, with no identifier or path sanitization, as **both** the generated client's class/namespace name **and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** — the zero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with the OpenAPI description could therefore: - **(CWE-22) write the generated source file to a path outside the `-o` output directory** — e.g. `clientClassName: "/var/www/html/shell"`; and - **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated client. Confirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied `clientClassName` / `clientNamespaceName`. ### Details `clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP): ``` # output FILENAME (CWE-22): clientClassName flows into the file path clientClassName: "/abs/path/PWNED" -> /abs/path/PWNED.cs (written outside -o) # class declaration (CWE-94): clientClassName flows verbatim into the type declaration clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient' -> public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { } ``` `clientNamespaceName` reached the analogous namespace/path sinks. ### Impact A developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description (without `-c`) could create/overwrite a generated source file at an attacker-influenced path and emit attacker-controlled text into the generated client. This does **not** reach clean remote code execution: because `clientClassName` is reused verbatim at multiple sites (the class name **and** the constructor name), injected code cannot be made to compile — it breaks the build. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity primitive is the file write. CWE-22 / CWE-94. ### Patches Fixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7884). `clientClassName` and `clientNamespaceName` sourced from `x-ms-kiota-info` are now sanitized before use: `GenerationConfiguration.SanitizeClientClassName` strips any character outside `[A-Za-z0-9_]` and any invalid leading character (falling back to `ApiClient`), and `SanitizeClientNamespaceName` restricts to `[A-Za-z0-9._-]`, collapses consecutive dots, strips invalid leading characters (falling back to `ApiSdk`). This removes path separators, drive/colon, `..`, quotes, and braces, so the values can no longer influence the output path or inject into the declaration. ### Remediation Upgrade to Kiota **1.29.1, 1.32.5,** or later and regenerate affected clients.

Source published

24 Jul 2026 16:12:14 UTC

Source modified

17 Aug 2026 15:00:08 UTC

Observed here

23 Oct 2026 16:01:25 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Publisher rating · HIGH