CVE-2026-59865: fallo crítico en microsoft kiota
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 4.4%
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
microsoft · kiotaCVEs relacionadas — microsoft kiota
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-59867HIGHKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refEPSS 2.4%CVE-2026-73851MEDIUMKiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)EPSS 2.3%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2026-59866CRITICALKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameEPSS 1.4%CVE-2026-59859HIGHKiota: Code Generation Literal Injection in the PHP GeneratorEPSS 1.4%CVE-2026-59860HIGHKiota: XML Doc-Comment Newline Breakout Code InjectionEPSS 1.4%