Summary
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the AI host when the generated plugin is deployed.
Confirmed on Kiota 1.32.4 (KIOTA_CONFIG_PREVIEW=true, the self-contained linux-x64 release binary).
Details
Both extension paths write the static_template.file reference straight into the manifest without sanitization, PluginsGenerationService.GetResponseSemanticsFromAdaptiveCardExtension mints static_template = {"file": <File>}, and the x-ai-capabilities path copies the static_template object through:
# spec -> generated manifest (functions[].capabilities.response_semantics)
x-ai-adaptive-card: {title: T, data_path: $.x,
file: "../../../../../../etc/passwd"} -> static_template.file = "../../../../../../etc/passwd" (CWE-22)
x-ai-capabilities.response_semantics.static_template:
{file: "../../../../../../etc/passwd"} -> static_template.file = "../../../../../../etc/passwd" (CWE-22)
(x-ai-adaptive-card.file only reaches the manifest when title is set, so GetResponseSemanticsFromAdaptiveCardExtension fires; otherwise kiota writes its own template card instead.)
Remediation
Upgrade to Kiota 1.32.5 or later and regenerate affected plugins.
Impact
This is not local code execution on the build host. The injected path is written into the generated plugin manifest and realized downstream, when the plugin is packaged and sideloaded / deployed to an AI host (Microsoft 365 Copilot / Teams) that resolves static_template.file relative to the plugin package (out-of-package file reference via ../). Kiota is the propagation point: it fails to reject ../ and absolute paths in this provider-supplied field before writing it into the manifest.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 1.32.5 (https://github.com/microsoft/kiota/pull/7892). static_template.file from both x-ai-adaptive-card and x-ai-capabilities is validated as a relative path confined to the plugin output package: absolute URIs, rooted/UNC paths, Windows drive paths, and .. traversal segments are rejected, and unsafe references are dropped with a warning. Regression tests cover .., absolute paths, and URI values.
Frequently Asked Questions
- What is CVE-2026-59864? CVE-2026-59864 is a critical-severity path traversal vulnerability in Microsoft.OpenApi.Kiota (nuget), affecting versions < 1.32.5. It is fixed in 1.32.5. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which packages are affected by CVE-2026-59864?
Microsoft.OpenApi.Kiota(nuget) (versions < 1.32.5)Microsoft.OpenApi.Kiota.Builder(nuget) (versions < 1.32.5)
- Is there a fix for CVE-2026-59864? Yes. CVE-2026-59864 is fixed in 1.32.5. Upgrade to this version or later.
- Is CVE-2026-59864 exploitable, and should I be worried? Whether CVE-2026-59864 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-59864 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-59864?
- Upgrade
Microsoft.OpenApi.Kiotato 1.32.5 or later - Upgrade
Microsoft.OpenApi.Kiota.Builderto 1.32.5 or later
- Upgrade