External risk intelligence

Kiota Command Injection via OpenAPI Description.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-59865

Kiota is a developer tool used for code generation. This vulnerability requires an attacker to provide a malicious OpenAPI description to a developer or a local build process, which is a build-time or developer-centric activity not typically exposed to or reachable from the public internet in standard deployment environments.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Kiota OpenAPI client code generator could allow an attacker to inject commands. This occurs when a specially crafted OpenAPI description is processed, potentially leading to the execution of unintended commands if the generated output is run. The main concern is confirming relevance and exposure to understand potential impact.

Malicious descriptions can inject commands.
Affects code generation and developer workflows.
Confirm relevance and exposure; no direct system impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by providing a specially crafted OpenAPI description to a developer using Kiota. When this description is processed, it can lead to command injection if the suggested installation command is executed, potentially allowing the attacker to run arbitrary commands on the developer's system.

Malicious OpenAPI description provided.
`kiota info` command executed.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow for command injection when an attacker-controlled OpenAPI description is processed by the `kiota info` command. This could occur if the description is manually run or through the Kiota VS Code extension's dependency installation flow.

System command execution.
Malicious OpenAPI description processed.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `kiota` OpenAPI-based HTTP client code generator is impacted by a command injection vulnerability. Real-world responsibility likely falls to development teams or platform engineers managing the code generation process and their tools. The initial practical step involves identifying instances where `kiota` is used, specifically for generating code from OpenAPI descriptions, and then confirming the scope and potential impact if malicious descriptions are processed.

Development or platform teams own this issue.
Verify affected `kiota` usage and OpenAPI sources.
Plan updates for development environments.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kiota and how is it used?

Kiota is a developer tool designed to generate HTTP client code from OpenAPI descriptions. It simplifies the process of interacting with APIs by automating the creation of SDKs for various programming languages. Developers typically use it within their local environments or build pipelines to consume API specifications and integrate them into their software projects.

How does this CVE-2026-59865 vulnerability work?

This is a command injection issue categorized under CWE-94 and CWE-829. It occurs because the software trusts and displays specific installation commands found within an OpenAPI file. If an attacker provides a malicious description, Kiota might present a harmful command as a recommendation, which, if executed by the developer, runs arbitrary code on their machine.

Does viewing an OpenAPI file trigger this vulnerability?

No. Simply having or viewing the file is not enough to trigger the issue. The vulnerability is triggered only when the Kiota tool processes a malicious file—specifically through the `kiota info` command or the associated VS Code extension's dependency installation flow—and the user subsequently runs the suggested, compromised installation command.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that risk is very unlikely for standard deployments because this is a developer-centric activity. Because Kiota is a build-time tool and not a network service, it is generally not exposed to the public internet, making it difficult for an attacker to reach your local build process unless they can influence the OpenAPI sources you use.

How do I address CVE-2026-59865 in my environment?

The primary step is to update the Kiota tool to version 1.32.5 or later. Beyond updating, development teams should review their processes for sourcing OpenAPI files to ensure they only use trusted and verified descriptions. If you use Kiota, coordinate with your team to verify your current version and apply the update in all development environments where the tool is installed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.