https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 05:03:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354321 EUVD-2026-354321 https://cve.radiocsirt.org/vuln/euvd-2026-354321 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59866 <p>Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.</p> <p>Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59866 https://cve.radiocsirt.org/vuln/ghsa-4vv7-jj25-4gh6 <p><strong>Affected:</strong> NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder</p> <p>### Summary</p> <p>Microsoft Kiota emitted the `x-ms-kiota-info` extension&#39;s `clientClassName` or `clientNamespaceName` value **raw**, with no identifier or path sanitization, as **both** the generated client&#39;s class/namespace name **and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** — the zero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in the description so consumers don&#39;t have to) — an attacker who controls or tampers with the OpenAPI description could therefore:</p> <p>- **(CWE-22) write the generated source file to a path outside the `-o` output directory** — e.g. `clientClassName: &#34;/var/www/html/shell&#34;`; and - **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated client.</p> <p>Confirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied `clientClassName` / `clientNamespaceName`.</p> <p>### Details</p> <p>`clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP):</p> <p>``` # output FILENAME (CWE-22): clientClassName flows into the file path clientClassName: &#34;/abs/path/PWNED&#34; -&gt; /abs/path/PWNED.cs (written outside -o)</p> <p># class declaration (CWE-94): clientClassName flows verba…</p> <p><strong>Affected:</strong> NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder</p> <p>### Summary</p> <p>Microsoft Kiota emitted the `x-ms-kiota-info` extension&#39;s `clientClassName` or `clientNamespaceName` value **raw**, with no identifier or path sanitization, as **both** the generated client&#39;s class/namespace name **and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** — the zero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in the description so consumers don&#39;t have to) — an attacker who controls or tampers with the OpenAPI description could therefore:</p> <p>- **(CWE-22) write the generated source file to a path outside the `-o` output directory** — e.g. `clientClassName: &#34;/var/www/html/shell&#34;`; and - **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated client.</p> <p>Confirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied `clientClassName` / `clientNamespaceName`.</p> <p>### Details</p> <p>`clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP):</p> <p>``` # output FILENAME (CWE-22): clientClassName flows into the file path clientClassName: &#34;/abs/path/PWNED&#34; -&gt; /abs/path/PWNED.cs (written outside -o)</p> <p># class declaration (CWE-94): clientClassName flows verba…</p> https://cve.radiocsirt.org/vuln/ghsa-4vv7-jj25-4gh6