CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Attackers can write files outside the workspace via poisoned config, potentially leading to code execution on developer or CI hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59863?
CVE-2026-59863 is a high-severity path traversal vulnerability in microsoft kiota, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.
Weakness: CWE-22
Which versions are affected by CVE-2026-59863?
8 open source packages ship an affected version, including Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.OpenApi.Kiota NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota NuGet | From 1.30.0 | 1.32.5 |
Microsoft.OpenApi.Kiota NuGet | From 1.30.0 | 1.32.5 |
Microsoft.OpenApi.Kiota.Builder NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota.Builder NuGet | All versions | 1.29.1 |
2 more packages
Microsoft.OpenApi.Kiota.Builder NuGet | From 1.30.0 | 1.32.5 |
Microsoft.OpenApi.Kiota.Builder NuGet | From 1.30.0 | 1.32.5 |
How do I fix CVE-2026-59863?
Upgrade Microsoft.OpenApi.Kiota to a fixed version for your release line: 1.29.1 or 1.32.5.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-59863 being exploited?
There is no known exploitation of CVE-2026-59863 in the wild and no public exploit code.
Sources
Also known as GHSA-4rj6-vrwv-wr8m.