Microsoft.OpenApi.Kiota.Builder vulnerabilities (NuGet)
12 vulnerabilities.
Microsoft.OpenApi.Kiota.BuilderNuGetKiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators8.8 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests3.1 LowMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref7.1 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName9.3 CriticalMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions9.3 CriticalMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`9.3 CriticalMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF7.0 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Code Generation Literal Injection in the PHP Generator8.7 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Code Generation Literal Injection in the Python Generator7.5 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Code Generation Literal Injection in Kiota Ruby Generator7.5 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: XML Doc-Comment Newline Breakout Code Injection8.7 HighMicrosoft.OpenApi.Kiota.BuilderNuGetKiota: Code Generation Literal Injection7.3 High