{"items":[{"id":"NVI-00015236","kind":"vulnerability","title":"Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p5rm-jg5c-8c77","CVE-2026-73851"],"plain_summary":"GitHub lists this reviewed advisory for Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-46c7785628feb2967b72fa73e6babdb5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-46c7785628feb2967b72fa73e6babdb5","url":"https://github.com/advisories/GHSA-p5rm-jg5c-8c77","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p5rm-jg5c-8c77","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:15:44.568Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-46c7785628feb2967b72fa73e6babdb5"],"technology":"Microsoft.OpenApi.Kiota","known_exclusions":[],"conditions_summary":"### Impact\n\nKiota generates AI plugin manifests from an OpenAPI description. When the description contains an `x-ai-capabilities` response semantics `static_template` (or the adaptive-card extension `x-ai-adaptive-card`), the `file` reference is written into the generated manifest's `response_semantics.static_template.file` and is later resolved by the AI host **relative to the plugin package**.\n\nAn attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a `file` reference that resolves **outside** the manifest package (e.g. `../../../../etc/passwd`, an absolute path, or a `file://` / `http(s)://` URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary (CWE-22 Path Traversal, CWE-829 Inclusion of Functionality from an Untrusted Control Sphere).\n\nA mitigation shipped in v1.32.5 (`ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference`) rejected literal traversal, rooted paths, drive-qualified paths, and absolute URIs. However, that check inspected the **raw** reference string, so **percent-encoded** payloads bypassed every check and were ","public_affected_ranges":[">= 1.30.0, < 1.34.0"]},{"certainty":"source_listed","source_ids":["sr-46c7785628feb2967b72fa73e6babdb5"],"technology":"Microsoft.OpenApi.Kiota","known_exclusions":[],"conditions_summary":"### Impact\n\nKiota generates AI plugin manifests from an OpenAPI description. When the description contains an `x-ai-capabilities` response semantics `static_template` (or the adaptive-card extension `x-ai-adaptive-card`), the `file` reference is written into the generated manifest's `response_semantics.static_template.file` and is later resolved by the AI host **relative to the plugin package**.\n\nAn attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a `file` reference that resolves **outside** the manifest package (e.g. `../../../../etc/passwd`, an absolute path, or a `file://` / `http(s)://` URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary (CWE-22 Path Traversal, CWE-829 Inclusion of Functionality from an Untrusted Control Sphere).\n\nA mitigation shipped in v1.32.5 (`ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference`) rejected literal traversal, rooted paths, drive-qualified paths, and absolute URIs. However, that check inspected the **raw** reference string, so **percent-encoded** payloads bypassed every check and were ","public_affected_ranges":["< 1.29.1"]}],"null_published_at":"2026-11-03T10:03:26.563Z","source_updated_at":"2026-08-17T15:11:54.000Z","source_disclosed_at":"2026-07-24T16:14:56.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:15:44.568Z"}],"next_cursor":null,"snapshot_revision":"42594"}