https://vulnerability.circl.lu/sightings/feed 2026-10-08T23:54:08.955307+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/31531b0d-0688-467e-8f7c-09dc66f38498/export 2026-10-08T23:54:08.985353+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "31531b0d-0688-467e-8f7c-09dc66f38498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105795", "type": "seen", "source": "https://gist.github.com/alon710/c6fdd994670d8b09e2a5ba7a20d069a4", "content": "# CVE-2026-105795: CVE-2026-105795: Unvalidated Custom Extension Path Traversal in Microsoft Kiota\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105795\n\n## Summary\nCVE-2026-105795 (GHSA-6gw6-rv2g-25mg) is a critical path traversal vulnerability in Microsoft Kiota, an OpenAPI-based HTTP client and plugin manifest generator. In affected versions (1.25.1 to < 1.35.0), Kiota propagates the unvalidated `x-ai-capabilities.response_semantics.oauth_card_path` vendor extension directly into generated API plugin manifests, leading to potential path traversal exploitation by downstream consumers.\n\n## TL;DR\nMicrosoft Kiota versions 1.25.1 to < 1.35.0 fail to validate the `oauth_card_path` parameter in custom OpenAPI extensions. An attacker can supply a malicious OpenAPI document to generate a compromised plugin manifest containing directory traversal segments, absolute paths, or external URIs, causing downstream execution hosts to access unauthorized files or external servers.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.1\n- **EPSS Score**: Not Registered\n- **Impact**: Low Integrity Impact, Downstream File Disclosure risk\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft Kiota CLI\n- Microsoft.OpenApi.Kiota NuGet Package\n- Microsoft.OpenApi.Kiota.Builder NuGet Package\n- **Microsoft Kiota CLI**: >= 1.25.1, < 1.35.0 (Fixed in: `1.35.0`)\n- **Microsoft.OpenApi.Kiota**: >= 1.25.1, < 1.35.0 (Fixed in: `1.35.0`)\n- **Microsoft.OpenApi.Kiota.Builder**: >= 1.25.1, < 1.35.0 (Fixed in: `1.35.0`)\n\n## Mitigation\n\n- Upgrade all Kiota CLI tools and library references to version 1.35.0 or above.\n- Implement static analysis scanning on generated JSON manifests to detect path traversal sequences.\n- Configure downstream consumer platforms to enforce strict path isolation boundaries on plugin packages.\n\n**Remediation Steps:**\n1. Identify all systems running the Kiota CLI using command: dotnet tool list -g.\n2. Upgrade the toolchain by running: dotnet tool update -g Microsoft.OpenApi.Kiota.\n3. Scan existing codebase .csproj files for Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder packages, updating their versions to >= 1.35.0.\n4. Deploy runtime path-validation updates to engines consuming the generated declarative plugin manifests.\n\n## References\n\n- [Official Microsoft Kiota Security Advisory](https://github.com/microsoft/kiota/security/advisories/GHSA-6gw6-rv2g-25mg)\n- [Fix Commit (fc0f219)](https://github.com/microsoft/kiota/commit/fc0f219b8a665c4c69be8befcff035ba0eb8e4ce)\n- [Kiota Version 1.35.0 Release Details](https://github.com/microsoft/kiota/releases/tag/v1.35.0)\n- [NVD CVE-2026-105795 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-105795)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105795) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T08:30:30.000000Z"} 2026-10-07T08:30:30+00:00