CVE-2026-73851

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73851", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-13T17:44:28.644Z", "datePublished": "2026-08-17T15:11:39.724Z", "dateUpdated": "2026-08-17T15:26:40.140Z"}, "containers": {"cna": {"title": "Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"}, {"name": "https://github.com/microsoft/kiota/issues/7912", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/issues/7912"}, {"name": "https://github.com/microsoft/kiota/pull/7910", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/pull/7910"}, {"name": "https://github.com/microsoft/kiota/pull/7913", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/pull/7913"}, {"name": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"}, {"name": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"}, {"name": "https://github.com/microsoft/kiota/releases/tag/v1.29.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1"}, {"name": "https://github.com/microsoft/kiota/releases/tag/v1.34.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"version": ">= 1.30.0, < 1.34.0", "status": "affected"}, {"version": "< 1.29.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:11:39.724Z"}, "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."}], "source": {"advisory": "GHSA-p5rm-jg5c-8c77", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T15:26:24.544956Z", "id": "CVE-2026-73851", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T15:26:40.140Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:26:24.544956Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T15:26:33.630Z"}}], "cna": {"title": "Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)", "source": {"advisory": "GHSA-p5rm-jg5c-8c77", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.34.0"}, {"status": "affected", "version": "< 1.29.1"}]}], "references": [{"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77", "name": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/microsoft/kiota/issues/7912", "name": "https://github.com/microsoft/kiota/issues/7912", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/pull/7910", "name": "https://github.com/microsoft/kiota/pull/7910", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/pull/7913", "name": "https://github.com/microsoft/kiota/pull/7913", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7", "name": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268", "name": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1", "name": "https://github.com/microsoft/kiota/releases/tag/v1.29.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0", "name": "https://github.com/microsoft/kiota/releases/tag/v1.34.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:11:39.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73851", "state": "PUBLISHED", "dateUpdated": "2026-08-17T15:26:40.140Z", "dateReserved": "2026-08-13T17:44:28.644Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-17T15:11:39.724Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kiota", "vendor": "microsoft", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.34.0"}, {"status": "affected", "version": "< 1.29.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de las versiones 1.29.1 y 1.34.0, un atacante que controla o manipula la descripci\u00f3n de OpenAPI consumida por Kiota puede proporcionar una referencia de archivo que se resuelve fuera del paquete del manifiesto (por ejemplo, .. / .. / .. / .. / etc/p4ssd, una ruta absoluta o una URI file: // / http(s)://). Cuando el manifiesto generado se despliega y es consumido por un host de IA, esto puede llevar a la inclusi\u00f3n o divulgaci\u00f3n de archivos fuera del l\u00edmite del paquete previsto. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.29.1 y 1.34.0."}], "id": "CVE-2026-73851", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73851", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T15:26:24.544956Z", "version": "2.0.3"}}]}, "published": "2026-08-17T15:16:57.980", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/issues/7912"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/pull/7910"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/pull/7913"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/releases/tag/v1.29.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/releases/tag/v1.34.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.30.0,1.34.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.29.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kiota", "source": "cna", "vendor": "microsoft"}, "product": "kiota", "vendor": "microsoft"}], "created": "2026-08-17T18:00:05.373047+00:00", "updated": "2026-08-18T15:15:03.808354+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$kiota"]}