CVE-2026-59863: Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota’s
documented team workflow has developers commit to their repository — unvalidated on
kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious
per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate
command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — the
outputPath was not confined to the workspace root and absolute paths were accepted.
Confirmed on Kiota 1.32.4 (KIOTA_CONFIG_PREVIEW=true, the self-contained linux-x64 release binary).
References
- github.com/advisories/GHSA-4rj6-vrwv-wr8m
- github.com/microsoft/kiota/commit/4049327872db7846ace35c9003774d3e3878e4e9
- github.com/microsoft/kiota/pull/7885
- github.com/microsoft/kiota/releases/tag/v1.32.5
- github.com/microsoft/kiota/security/advisories/GHSA-4rj6-vrwv-wr8m
- nvd.nist.gov/vuln/detail/CVE-2026-59863
Code Behaviors & Features
Detect and mitigate CVE-2026-59863 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →