CVE-2026-59866

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

# output FILENAME (CWE-22): clientClassName flows into the file path
clientClassName: "/abs/path/PWNED"   ->   /abs/path/PWNED.cs   (written outside -o)

# class declaration (CWE-94): clientClassName flows verbatim into the type declaration
clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient'
   ->  public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }

A developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description
(without -c) could create/overwrite a generated source file at an attacker-influenced path and emit
attacker-controlled text into the generated client.

This does not reach clean remote code execution: because clientClassName is reused verbatim at multiple
sites (the class name and the constructor name), injected code cannot be made to compile, it breaks the
build. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity
primitive is the file write. CWE-22 / CWE-94.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

Already deployed Kodem?

Fixed in 1.32.5 (https://github.com/microsoft/kiota/pull/7884). clientClassName and
clientNamespaceName sourced from x-ms-kiota-info are now sanitized before use:
GenerationConfiguration.SanitizeClientClassName strips any character outside [A-Za-z0-9_] and any invalid
leading character (falling back to ApiClient), and SanitizeClientNamespaceName restricts to
[A-Za-z0-9._-], collapses consecutive dots, strips invalid leading characters (falling back to ApiSdk).
This removes path separators, drive/colon, .., quotes, and braces, so the values can no longer influence
the output path or inject into the declaration.

1. What is CVE-2026-59866? CVE-2026-59866 is a high-severity path traversal vulnerability in Microsoft.OpenApi.Kiota (nuget), affecting versions < 1.32.5. It is fixed in 1.32.5. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which packages are affected by CVE-2026-59866?
   • Microsoft.OpenApi.Kiota (nuget) (versions < 1.32.5)
   • Microsoft.OpenApi.Kiota.Builder (nuget) (versions < 1.32.5)
3. Is there a fix for CVE-2026-59866? Yes. CVE-2026-59866 is fixed in 1.32.5. Upgrade to this version or later.
4. Is CVE-2026-59866 exploitable, and should I be worried? Whether CVE-2026-59866 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-59866 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-59866?
   • Upgrade Microsoft.OpenApi.Kiota to 1.32.5 or later
   • Upgrade Microsoft.OpenApi.Kiota.Builder to 1.32.5 or later

Other vulnerabilities in Microsoft.OpenApi.Kiota