No access to your tenant or devices. Every item links to its source. What this means
CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Exact risk observation. Current source statements above are a separate evidence layer. Latest risk evidence.
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 1.41 % · percentile 72.52 % · scored 25 Oct 2026.
Observed 25 Oct 2026 15:18:41 UTC · Complete immutable risk JSON
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-22 · CWE-94
published: 2026-07-16T16:19:15.493
lastModified: 2026-10-24T20:10:00.137
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
### Summary Microsoft Kiota emitted the `x-ms-kiota-info` extension's `clientClassName` or `clientNamespaceName` value **raw**, with no identifier or path sanitization, as **both** the generated client's class/namespace name **and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** — the zero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with the OpenAPI description could therefore: - **(CWE-22) write the generated source file to a path outside the `-o` output directory** — e.g. `clientClassName: "/var/www/html/shell"`; and - **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated client. Confirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied `clientClassName` / `clientNamespaceName`. ### Details `clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP): ``` # output FILENAME (CWE-22): clientClassName flows into the file path clientClassName: "/abs/path/PWNED" -> /abs/path/PWNED.cs (written outside -o) # class declaration (CWE-94): clientClassName flows verbatim into the type declaration clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient' -> public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { } ``` `clientNamespaceName` reached the analogous namespace/path sinks. ### Impact A developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description (without `-c`) could create/overwrite a generated source file at an attacker-influenced path and emit attacker-controlled text into the generated client. This does **not** reach clean remote code execution: because `clientClassName` is reused verbatim at multiple sites (the class name **and** the constructor name), injected code cannot be made to compile — it breaks the build. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity primitive is the file write. CWE-22 / CWE-94. ### Patches Fixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7884). `clientClassName` and `clientNamespaceName` sourced from `x-ms-kiota-info` are now sanitized before use: `GenerationConfiguration.SanitizeClientClassName` strips any character outside `[A-Za-z0-9_]` and any invalid leading character (falling back to `ApiClient`), and `SanitizeClientNamespaceName` restricts to `[A-Za-z0-9._-]`, collapses consecutive dots, strips invalid leading characters (falling back to `ApiSdk`). This removes path separators, drive/colon, `..`, quotes, and braces, so the values can no longer influence the output path or inject into the declaration. ### Remediation Upgrade to Kiota **1.29.1, 1.32.5,** or later and regenerate affected clients.
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Publisher rating · HIGH