Microsoft Kiota Path Injection Vulnerability: What You Need to Know
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- Microsoft.OpenApi.Kiota (nuget)
- Affected versions
- < 1.31.1 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.3 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.5 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.5 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.5 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.0 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.5 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.4 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.34.0 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.32.5, <= 1.32.5 or >= 1.33.0, <= 1.33.0 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.5 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.32.0, <= 1.32.0 or >= 1.32.1, <= 1.32.1 or >= 1.32.2, <= 1.32.2 or >= 1.32.3, <= 1.32.3 or >= 1.32.4, <= 1.32.4 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1 or < 1.32.0 or >= 0.1.0-preview, <= 0.1.0-preview or >= 0.1.1-preview, <= 0.1.1-preview or >= 0.1.2-preview, <= 0.1.2-preview or >= 0.1.3-preview, <= 0.1.3-preview or >= 0.10.0-preview, <= 0.10.0-preview or >= 0.11.0-preview, <= 0.11.0-preview or >= 0.11.1-preview, <= 0.11.1-preview or >= 0.2.0-preview, <= 0.2.0-preview or >= 0.2.1-preview, <= 0.2.1-preview or >= 0.3.0-preview, <= 0.3.0-preview or >= 0.4.0-preview, <= 0.4.0-preview or >= 0.5.0-preview, <= 0.5.0-preview or >= 0.5.1-preview, <= 0.5.1-preview or >= 0.6.0-preview, <= 0.6.0-preview or >= 0.7.1-preview, <= 0.7.1-preview or >= 0.8.3-preview, <= 0.8.3-preview or >= 0.9.0-preview, <= 0.9.0-preview or >= 1.0.0, <= 1.0.0 or >= 1.0.1, <= 1.0.1 or >= 1.1.0, <= 1.1.0 or >= 1.1.1, <= 1.1.1 or >= 1.1.2, <= 1.1.2 or >= 1.1.3, <= 1.1.3 or >= 1.10.0, <= 1.10.0 or >= 1.10.1, <= 1.10.1 or >= 1.11.0, <= 1.11.0 or >= 1.11.1, <= 1.11.1 or >= 1.12.0, <= 1.12.0 or >= 1.13.0, <= 1.13.0 or >= 1.14.0, <= 1.14.0 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.18.0, <= 1.18.0 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.2.0, <= 1.2.0 or >= 1.2.1, <= 1.2.1 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.23.0, <= 1.23.0 or >= 1.24.0, <= 1.24.0 or >= 1.24.1, <= 1.24.1 or >= 1.24.2, <= 1.24.2 or >= 1.24.3, <= 1.24.3 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.29.0, <= 1.29.0 or >= 1.3.0, <= 1.3.0 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.31.1, <= 1.31.1 or >= 1.4.0, <= 1.4.0 or >= 1.5.0, <= 1.5.0 or >= 1.5.1, <= 1.5.1 or >= 1.6.1, <= 1.6.1 or >= 1.7.0, <= 1.7.0 or >= 1.8.0, <= 1.8.0 or >= 1.8.1, <= 1.8.1 or >= 1.8.2, <= 1.8.2 or >= 1.9.0, <= 1.9.0 or >= 1.9.1, <= 1.9.1
- Patched version
- Not yet available
GHSA-4JWF-M4WG-8P66
An early warning has been issued for a path injection vulnerability in the Microsoft Kiota package. This vulnerability affects certain versions of Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.
What happened
The vulnerability allows an attacker-controlled path to be injected into the generated Copilot plugin manifest. This occurs when using the `kiota plugin add` or `kiota plugin generate` commands with the `-t APIPlugin` option. The issue was first flagged on July 24, 2026.
Affected versions of Microsoft.OpenApi.Kiota include those less than 1.31.1 or greater than or equal to 0.1.0-preview. For Microsoft.OpenApi.Kiota.Builder, affected versions include those less than 1.32.5 or greater than or equal to 0.2.0-preview.
What to do about it
- Avoid using the `kiota plugin add` or `kiota plugin generate` commands with the `-t APIPlugin` option until a patch is available.
- Monitor for updates from Microsoft regarding this vulnerability.
- Check your project dependencies for affected versions of Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.
- If using affected versions, consider downgrading to a non-affected version if possible.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
Microsoft.OpenApi.Kiota is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Microsoft.OpenApi.Kiota versions less than 1.31.1 or greater than or equal to 0.1.0-preview, or Microsoft.OpenApi.Kiota.Builder versions less than 1.32.5 or greater than or equal to 0.2.0-preview.
What should I do right now?
Avoid using the `kiota plugin add` or `kiota plugin generate` commands with the `-t APIPlugin` option. Monitor for updates from Microsoft and check your project dependencies for affected versions.
Is there a patch available?
No official fix has been published yet. Monitor the sources for updates.