kiota vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

KI

Product

kiota

by microsoft · last CVE Oct 6, 2026

13

CVEs

0

On KEV

9.3

Max CVSS

2

New 30D

Vulnerabilities13 In the news0 Timeline

Severity mix

Critical 3High 8Medium 1Low 1

Severity

All severities13 Critical3 High8 Medium1 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add kiota to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-59866	9.3	1%	Jul 16	Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59864	9.3	1%	Jul 16	Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59865	9.3	4%	Jul 16	Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-105796	8.8	1%	Oct 6	Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators Affected: >= 0.5.0, < 1.35.0
CVE-2026-59859	8.7	1%	Jul 16	Kiota: Code Generation Literal Injection in the PHP Generator Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59860	8.7	1%	Jul 16	Kiota: XML Doc-Comment Newline Breakout Code Injection Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-41134	7.8	0%	Apr 22	Kiota: Code Generation Literal Injection Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59862	7.5	1%	Jul 16	Kiota: Code Generation Literal Injection in the Python Generator Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59861	7.5	2%	Jul 16	Kiota: Code Generation Literal Injection in Kiota Ruby Generator Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59867	7.1	2%	Jul 16	Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-59863	7.0	1%	Jul 16	Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF Affected: >= 1.30.0, < 1.31.1; < 1.29.1
CVE-2026-73851	6.1	2%	Aug 17	Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass) Affected: >= 1.30.0, < 1.34.0; < 1.29.1
CVE-2026-105795	3.1	1%	Oct 6	Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests Affected: >= 1.25.1, < 1.35.0