GHSA-4VV7-JJ25-4GH6

Vulnerability from github – Published: 2026-07-24 16:12 – Updated: 2026-07-24 16:12
VLAI
Summary
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Details

Summary

Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/--class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with the OpenAPI description could therefore:

  • (CWE-22) write the generated source file to a path outside the -o output directory — e.g. clientClassName: "/var/www/html/shell"; and
  • (CWE-94) inject arbitrary text into the generated class/namespace declaration, corrupting the generated client.

Confirmed on Kiota 1.32.4 (the self-contained linux-x64 release binary), i.e. after the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied clientClassName / clientNamespaceName.

Details

clientClassName reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP):

# output FILENAME (CWE-22): clientClassName flows into the file path
clientClassName: "/abs/path/PWNED"   ->   /abs/path/PWNED.cs   (written outside -o)

# class declaration (CWE-94): clientClassName flows verbatim into the type declaration
clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient'
   ->  public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }

clientNamespaceName reached the analogous namespace/path sinks.

Impact

A developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description (without -c) could create/overwrite a generated source file at an attacker-influenced path and emit attacker-controlled text into the generated client.

This does not reach clean remote code execution: because clientClassName is reused verbatim at multiple sites (the class name and the constructor name), injected code cannot be made to compile — it breaks the build. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity primitive is the file write. CWE-22 / CWE-94.

Patches

Fixed in 1.32.5 (https://github.com/microsoft/kiota/pull/7884). clientClassName and clientNamespaceName sourced from x-ms-kiota-info are now sanitized before use: GenerationConfiguration.SanitizeClientClassName strips any character outside [A-Za-z0-9_] and any invalid leading character (falling back to ApiClient), and SanitizeClientNamespaceName restricts to [A-Za-z0-9._-], collapses consecutive dots, strips invalid leading characters (falling back to ApiSdk). This removes path separators, drive/colon, .., quotes, and braces, so the values can no longer influence the output path or inject into the declaration.

Remediation

Upgrade to Kiota 1.32.5 or later and regenerate affected clients.

Severity
7.0 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.32.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.OpenApi.Kiota.Builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.32.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59866"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:12:14Z",
    "nvd_published_at": "2026-07-16T16:19:15Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nMicrosoft Kiota emitted the `x-ms-kiota-info` extension\u0027s `clientClassName` or `clientNamespaceName` value\n**raw**, with no identifier or path sanitization, as **both** the generated client\u0027s class/namespace name\n**and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** \u2014 the\nzero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in\nthe description so consumers don\u0027t have to) \u2014 an attacker who controls or tampers with the OpenAPI description\ncould therefore:\n\n- **(CWE-22) write the generated source file to a path outside the `-o` output directory** \u2014 e.g.\n  `clientClassName: \"/var/www/html/shell\"`; and\n- **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated\n  client.\n\nConfirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier\nwriter-sink hardening \u2014 that fix escaped property/enum/default/serialization sinks but never sanitized the\nprovider-supplied `clientClassName` / `clientNamespaceName`.\n\n### Details\n\n`clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred\nfor Java, Go, TypeScript, Python, and PHP):\n\n```\n# output FILENAME (CWE-22): clientClassName flows into the file path\nclientClassName: \"/abs/path/PWNED\"   -\u003e   /abs/path/PWNED.cs   (written outside -o)\n\n# class declaration (CWE-94): clientClassName flows verbatim into the type declaration\nclientClassName: \u0027Pwn { } public class INJECTED { } public partial class RealClient\u0027\n   -\u003e  public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }\n```\n\n`clientNamespaceName` reached the analogous namespace/path sinks.\n\n### Impact\n\nA developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description\n(without `-c`) could create/overwrite a generated source file at an attacker-influenced path and emit\nattacker-controlled text into the generated client.\n\nThis does **not** reach clean remote code execution: because `clientClassName` is reused verbatim at multiple\nsites (the class name **and** the constructor name), injected code cannot be made to compile \u2014 it breaks the\nbuild. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity\nprimitive is the file write. CWE-22 / CWE-94.\n\n### Patches\n\nFixed in **1.32.5** (https://github.com/microsoft/kiota/pull/7884). `clientClassName` and\n`clientNamespaceName` sourced from `x-ms-kiota-info` are now sanitized before use:\n`GenerationConfiguration.SanitizeClientClassName` strips any character outside `[A-Za-z0-9_]` and any invalid\nleading character (falling back to `ApiClient`), and `SanitizeClientNamespaceName` restricts to\n`[A-Za-z0-9._-]`, collapses consecutive dots, strips invalid leading characters (falling back to `ApiSdk`).\nThis removes path separators, drive/colon, `..`, quotes, and braces, so the values can no longer influence\nthe output path or inject into the declaration.\n\n### Remediation\n\nUpgrade to Kiota **1.32.5** or later and regenerate affected clients.",
  "id": "GHSA-4vv7-jj25-4gh6",
  "modified": "2026-07-24T16:12:14Z",
  "published": "2026-07-24T16:12:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59866"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/pull/7884"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/kiota"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.