CyberRota Analysis
AI-GeneratedKiota versions 1.25.1 to 1.35.0 are vulnerable to a directory traversal issue that allows an attacker to manipulate the API plugin manifest by injecting unsafe file references from a compromised OpenAPI description. This could lead to unauthorized access or execution of unintended authentication mechanisms on the consuming host. Organizations using affected versions of Kiota should prioritize upgrading to version 1.35.0 to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0.