CyberRota Analysis
AI-GeneratedKiota, an OpenAPI-based HTTP client code generator, is vulnerable to file inclusion and disclosure attacks when an attacker manipulates the OpenAPI description to reference files outside the intended package boundaries. This can lead to unauthorized access to sensitive files, such as system configuration files. Organizations using Kiota versions prior to 1.29.1 and 1.34.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.