https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T11:18:05.155717+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59863 CVE-2026-59863 — Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF 2026-10-12T11:18:05.156784+00:00

Affected: microsoft kiota

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.