Critical· 9.3official fix available
CVE-2026-59866
Kiota, an OpenAPI-based HTTP client code generator, had a vulnerability in versions before 1.32.5 that allowed attackers to write generated code outside the intended output directory and inject malicious content. This was fixed in version 1.32.5 by adding input sanitization.
publishedJul 16, 2026
last modifiedJul 29, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
1%
69th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of Kiota versions prior to 1.32.5
02
Real-world impact
Attackers could potentially execute arbitrary code or access unintended files by exploiting unsanitized output paths.
03
Why this severity
CVSS 9.3 (Critical): High risk due to potential for remote code execution or file system compromise.
04
What to do about it
official fix available
recommended steps
- 01Upgrade Kiota to version 1.32.5 or later to apply the built-in input sanitization fix.
NVD description stating the fix is available in Kiota 1.32.5
05
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 29, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →