External risk intelligence

Kiota Code Generator Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-59866

Kiota is a developer tool used for client code generation. The vulnerability occurs during the build-time process when generating source code from OpenAPI descriptions. It is not a network-exposed service, appliance, or runtime component, but rather a utility used within developer environments or CI/CD pipelines, making public internet exposure of the vulnerable surface very unlikely.

Path Traversal

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Kiota, a tool for generating HTTP client code from OpenAPI descriptions. If a compromised or attacker-controlled OpenAPI description is used with the `kiota generate` command, it could allow the generation of malicious code outside of the intended output directory. The main concern is confirming relevance and exposure within your development and build processes.

Generated code can be placed maliciously.
Affects code generation in development.
Confirm if your development process uses this tool.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a development or build environment by introducing a malicious OpenAPI description. When the Kiota tool processes this description to generate client code, it can be tricked into writing files outside its designated output directory, potentially overwriting existing files or injecting arbitrary code into generated source files. This could lead to the execution of arbitrary code on the build system.

Attacker provides a malicious OpenAPI description.
`kiota generate` command runs without specific class/namespace names.
Arbitrary code execution on the build system.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker-controlled OpenAPI description to inject arbitrary text into generated client code and write generated source files outside the intended output directory when `kiota generate` is run without specifying a client class name.

Generated client code and source files.
Malicious OpenAPI description during code generation.
Arbitrary code injection or file manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Kiota affects the code generation process, meaning platform or build engineering teams responsible for the CI/CD pipeline or development environments are likely to manage remediation. The first practical step is to identify all instances where `kiota generate` is used, assess the risk based on whether compromised OpenAPI descriptions can be introduced, and then coordinate the update with the development teams.

Platform/build engineering teams own remediation.
Verify `kiota generate` usage in pipelines.
Update Kiota to version 1.32.5.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kiota and how does it relate to OpenAPI?

Kiota is a developer-focused command-line tool that automates the creation of HTTP client libraries. Developers provide an OpenAPI description—a structured definition of an API—and Kiota generates the source code required to interact with that service. It is primarily used during software development and build processes to ensure client code remains synchronized with API updates, saving developers from writing repetitive network request logic.

How does CVE-2026-59866 enable path traversal and code injection?

This vulnerability involves two weakness classes: Path Traversal (CWE-22) and Code Injection (CWE-94). Because the tool failed to sanitize input from OpenAPI files, it could be tricked into interpreting malicious data as file paths or programming syntax. This allows the generator to write files outside of its intended folder or insert unauthorized commands directly into the generated source code files.

What triggers the vulnerability in the Kiota generation process?

The flaw is triggered when running the 'kiota generate' command without manually specifying the client class or namespace name. When these identifiers are omitted, the tool relies on unvalidated values from the OpenAPI description to build its file structure. If the tool is invoked with an explicit class name using the provided configuration flags, the vulnerable code path is bypassed and the issue does not occur.

Do I need to worry about internet exposure for this CVE?

According to Halo Surface Signal, public internet exposure for this specific vulnerability is very unlikely. Because Kiota is a build-time utility rather than a network-facing service, an attacker cannot exploit it remotely over the web. The primary concern is internal security: the vulnerability manifests only if a malicious or untrusted OpenAPI description is introduced into your private development environments or automated CI/CD build pipelines.

How should I respond if my team uses Kiota?

The most effective first step is to upgrade your installation to version 1.32.5 or higher. This update introduces specific sanitization functions that properly clean class and namespace names during generation. You should also audit your build scripts to ensure they use explicit naming configurations where possible and implement processes to verify the integrity and source of any OpenAPI descriptions used in your pipelines.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.