Critical Path Injection Found in Microsoft Kiota

Microsoft has released a critical security update for its Kiota tool, addressing a path injection vulnerability tracked as CVE-2026-59864. The flaw allows an attacker to inject arbitrary file paths into generated Microsoft 365 Copilot and Teams plugin manifests, potentially leading to unauthorized file inclusion when the plugin is deployed.

What's at Risk

The vulnerability affects Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder versions prior to 1.32.5. Organizations utilizing these tools to generate AI-plugin manifests are at risk if they process untrusted or compromised OpenAPI descriptions.

This issue primarily impacts developers and enterprises that integrate Kiota into their CI/CD pipelines to automate the creation of Copilot plugins. Because the injected path is realized downstream during the plugin's deployment on an AI host, any system that consumes these generated manifests is potentially exposed to the consequences of the malicious file reference.

How the Flaw Works

This vulnerability is classified as a path traversal (CWE-22) and out-of-package file inclusion (CWE-829). In general, these types of flaws occur when an application fails to properly sanitize user-supplied input before using it to construct a file path. By including sequences like ../, an attacker can escape the intended directory structure.

When an application blindly trusts input from an external source—such as an OpenAPI specification—to define where a system should look for resources, it effectively grants the attacker control over the application's file access logic. In the context of plugin manifests, this allows an attacker to point the AI host toward sensitive files that should not be accessible to the plugin, potentially leading to information disclosure or other unintended behaviors once the plugin is active in a production environment.

How to Protect Your Systems

• Update Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder to version 1.32.5 or higher immediately.
• Review all OpenAPI descriptions currently used in your generation pipelines to ensure they originate from trusted sources.
• Implement strict input validation for all configuration files and specifications processed by automated build tools.
• Adopt the principle of least privilege for the AI hosts and service accounts that deploy or execute your generated plugins.
• Monitor deployment logs for unusual file access patterns or unexpected attempts to reference directories outside of the designated plugin package.

Given the critical severity of this vulnerability, prompt patching is essential to prevent the generation of compromised manifest files. Organizations should prioritize updating their development environments to ensure that all future plugin builds incorporate the necessary sanitization logic provided in the latest release.