CyberRota Analysis
AI-GeneratedThe Kiota HTTP Client code generator for Windows prior to version 1.32.5 is vulnerable to a directory traversal issue that allows malicious repositories or pull requests to write generated client files outside the designated workspace. This could lead to unauthorized file access or overwriting critical files on developer or CI hosts. Developers and CI/CD pipeline managers using affected versions should prioritize upgrading to version 1.32.5 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.32.5.