CVE-2026-59863: Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
(updated )
Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota’s
documented team workflow has developers commit to their repository — unvalidated on
kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious
per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate
command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — the
outputPath was not confined to the workspace root and absolute paths were accepted.
Confirmed on Kiota 1.32.4 (KIOTA_CONFIG_PREVIEW=true, the self-contained linux-x64 release binary).
References
- github.com/advisories/GHSA-4rj6-vrwv-wr8m
- github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9
- github.com/microsoft/kiota/pull/7885
- github.com/microsoft/kiota/releases/tag/v1.32.5
- github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m
- nvd.nist.gov/vuln/detail/CVE-2026-59863
Code Behaviors & Features
Detect and mitigate CVE-2026-59863 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →