Security readout for executives and security teams
Plain-English summary
A malicious or compromised OpenAPI description could make Kiota display an attacker-supplied dependency installation command as trusted guidance. If that command was executed manually or through the Kiota VS Code dependency-install flow, attacker-controlled commands could run. Microsoft fixed this in Kiota 1.32.5.
Executive priority
Prioritize remediation for teams that use Kiota with external API descriptions. This is critical because it can turn a documentation or API-specification trust issue into command execution in developer tooling, but public evidence of exploitation is not provided.
Technical view
Before 1.32.5, `kiota info` trusted `x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand` and related dependency values from the input OpenAPI description. This created command-injection risk when downstream users or tooling consumed the generated install recommendation. The issue is tracked as CWE-829 and CWE-94 with CVSS 4.0 score 9.3.
Likely exposure
Exposure is most likely in developer environments, CI tooling, or editor workflows using Microsoft Kiota versions before 1.32.5 against third-party, generated, or potentially compromised OpenAPI descriptions.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not marked KEV. The practical risk is supply-chain style: the attacker needs influence over an OpenAPI description that Kiota processes and that a user or extension flow trusts for dependency installation.
Researcher notes
The key trust boundary is OpenAPI description metadata flowing into install-command recommendations. Sources identify the vulnerable behavior and fixed version, but do not provide broader ecosystem impact, confirmed exploitation, or complete details on all VS Code extension handling paths.
Mitigation direction
- Upgrade Microsoft Kiota to version 1.32.5 or later.
- Review Kiota VS Code extension workflows that consume dependency-install output.
- Treat external OpenAPI descriptions as untrusted input.
- Avoid running spec-provided install commands without independent review.
- Check Microsoft Kiota advisory and release notes for updated guidance.
Validation and detection
- Inventory Kiota installations and confirm none are below 1.32.5.
- Identify workflows using `kiota info` with third-party OpenAPI descriptions.
- Review recent OpenAPI descriptions for `x-ms-kiota-info` dependency command fields.
- Check developer documentation for instructions relying on Kiota-generated install commands.
- Confirm CI or editor automation does not execute unreviewed dependency-install recommendations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-829: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-59865 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/microsoft/kiota/security/advisories/GHSA-hq9q-27g5-qwpjCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/microsoft/kiota/pull/7883CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/kiota/commit/e1d6d76c6eecbe50785429166faaf8c831e036c6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/kiota/releases/tag/v1.32.5CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inclusion of Functionality from Untrusted Control Sphere
Inclusion of Functionality from Untrusted Control Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.