Microsoft Kiota Path Traversal Vulnerability Under Investigation
An early warning has been issued regarding a potential path traversal vulnerability in the Microsoft Kiota package, which may allow an attacker to inject a path/URL into the generated Copilot plugin manifest.
What happened
Reportedly, the vulnerability occurs when using the `kiota plugin add` or `kiota plugin generate` commands with the `-t APIPlugin` option. The affected components are Microsoft.OpenApi.Kiota (nuget) 1.32.4 and Microsoft.OpenApi.Kiota.Builder (nuget) 1.32.4. This issue is currently under investigation with tracked IDs GHSA-4JWF-M4WG-8P66 and GHSA-hq9q-27g5-qwpj.
To assess your exposure, check if your projects are using the affected versions of the Microsoft Kiota package. It is recommended to upgrade to versions that include a fix for this vulnerability, or avoid using the affected commands with untrusted input. For more details, consult the primary sources: [GHSA-4jwf-m4wg-8p66](https://github.com/advisories/GHSA-4jwf-m4wg-8p66) and [GHSA-hq9q-27g5-qwpj](https://github.com/advisories/GHSA-hq9q-27g5-qwpj).
Given the high severity of this potential vulnerability, it is advisable to stay updated with the latest information from the primary sources and apply necessary mitigations as soon as fixes are available.
How 0Day mitigates this
Microsoft.OpenApi.Kiota is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.