Microsoft.OpenApi.Kiota vulnerabilities (NuGet)
13 vulnerabilities.
Microsoft.OpenApi.KiotaNuGetKiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators8.8 HighMicrosoft.OpenApi.KiotaNuGetKiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests3.1 LowMicrosoft.OpenApi.KiotaNuGetKiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)6.1 MediumMicrosoft.OpenApi.KiotaNuGetKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref7.1 HighMicrosoft.OpenApi.KiotaNuGetKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName9.3 CriticalMicrosoft.OpenApi.KiotaNuGetKiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions9.3 CriticalMicrosoft.OpenApi.KiotaNuGetKiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`9.3 CriticalMicrosoft.OpenApi.KiotaNuGetKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF7.0 HighMicrosoft.OpenApi.KiotaNuGetKiota: Code Generation Literal Injection in the PHP Generator8.7 HighMicrosoft.OpenApi.KiotaNuGetKiota: Code Generation Literal Injection in the Python Generator7.5 HighMicrosoft.OpenApi.KiotaNuGetKiota: Code Generation Literal Injection in Kiota Ruby Generator7.5 HighMicrosoft.OpenApi.KiotaNuGetKiota: XML Doc-Comment Newline Breakout Code Injection8.7 HighMicrosoft.OpenApi.KiotaNuGetKiota: Code Generation Literal Injection7.3 High