CVE-2026-59865
Kiota, an OpenAPI‑based HTTP client generator, had a flaw that let attackers inject shell commands through a dependency install command supplied in an OpenAPI description. The vulnerability could be exploited by running the suggested command, allowing arbitrary code execution. It was fixed in Kiota 1.32.5.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Kiota OpenAPI HTTP client code generator, any version earlier than 1.32.5.
Real-world impact
An attacker could run arbitrary shell commands on a system that uses Kiota to install dependencies, potentially taking full control of that system.
Why this severity
The CVSS score of 9.3 reflects that the flaw is easy to exploit (low attack complexity, no user interaction) and has a high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Kiota to version 1.32.5 or later.
NVD-referenced vendor advisory
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 29, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.