Skip to content

[GHSA-4jwf-m4wg-8p66] Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions #9147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
baywet wants to merge 1 commit into from
+4 −4
Closed

[GHSA-4jwf-m4wg-8p66] Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions #9147

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions advisories/github-reviewed/2026/07/GHSA-4jwf-m4wg-8p66/GHSA-4jwf-m4wg-8p66.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jwf-m4wg-8p66",
"modified": "2026-08-17T14:54:42Z",
"modified": "2026-08-17T14:54:43Z",
"published": "2026-07-24T15:58:31Z",
"aliases": [
"CVE-2026-59864"
],
"summary": "Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions",
"details": "### Summary\n\n`kiota plugin add` / `kiota plugin generate` (with `-t APIPlugin`) emits an attacker-controlled `static_template.file` path from the AI-plugin extensions (`x-ai-adaptive-card`, `x-ai-capabilities`) **verbatim**, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (`<name>-apiplugin.json`). An attacker-controlled or compromised OpenAPI description can therefore embed a `../` / absolute path into the manifest's `response_semantics.static_template.file`, yielding a **path traversal (CWE-22)** / out-of-package file inclusion (CWE-829) that is resolved by the AI host when the generated plugin is deployed.\n\nConfirmed on Kiota **1.32.4** (`KIOTA_CONFIG_PREVIEW=true`, the self-contained `linux-x64` release binary).\n\n### Details\n\nBoth extension paths write the `static_template.file` reference straight into the manifest without sanitization — `PluginsGenerationService.GetResponseSemanticsFromAdaptiveCardExtension` mints `static_template = {\"file\": <File>}`, and the `x-ai-capabilities` path copies the `static_template` object through:\n\n```\n# spec -> generated manifest (functions[].capabilities.response_semantics)\nx-ai-adaptive-card: {title: T, data_path: $.x,\n file: \"../../../../../../etc/passwd\"} -> static_template.file = \"../../../../../../etc/passwd\" (CWE-22)\nx-ai-capabilities.response_semantics.static_template:\n {file: \"../../../../../../etc/passwd\"} -> static_template.file = \"../../../../../../etc/passwd\" (CWE-22)\n```\n\n(`x-ai-adaptive-card.file` only reaches the manifest when `title` is set, so `GetResponseSemanticsFromAdaptiveCardExtension` fires; otherwise kiota writes its own template card instead.)\n\n### Impact\n\n**This is not local code execution on the build host.** The injected path is written into the generated plugin manifest and realized **downstream**, when the plugin is packaged and sideloaded / deployed to an AI host (Microsoft 365 Copilot / Teams) that resolves `static_template.file` relative to the plugin package (out-of-package file reference via `../`). Kiota is the propagation point: it fails to reject `../` and absolute paths in this provider-supplied field before writing it into the manifest.\n\n### Patches\n\nFixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7892). `static_template.file` from both `x-ai-adaptive-card` and `x-ai-capabilities` is validated as a relative path confined to the plugin output package: absolute URIs, rooted/UNC paths, Windows drive paths, and `..` traversal segments are rejected, and unsafe references are dropped with a warning. Regression tests cover `..`, absolute paths, and URI values.\n\n### Remediation\n\nUpgrade to Kiota **1.29.1, 1.32.5** or later and regenerate affected plugins.",
"details": "### Summary\n\n`kiota plugin add` / `kiota plugin generate` (with `-t APIPlugin`) emits an attacker-controlled `static_template.file` path from the AI-plugin extensions (`x-ai-adaptive-card`, `x-ai-capabilities`) **verbatim**, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (`<name>-apiplugin.json`). An attacker-controlled or compromised OpenAPI description can therefore embed a `../` / absolute path into the manifest's `response_semantics.static_template.file`, yielding a **path traversal (CWE-22)** / out-of-package file inclusion (CWE-829) that is resolved by the AI host when the generated plugin is deployed.\n\nConfirmed on Kiota **1.32.4** (`KIOTA_CONFIG_PREVIEW=true`, the self-contained `linux-x64` release binary).\n\n### Details\n\nBoth extension paths write the `static_template.file` reference straight into the manifest without sanitization — `PluginsGenerationService.GetResponseSemanticsFromAdaptiveCardExtension` mints `static_template = {\"file\": <File>}`, and the `x-ai-capabilities` path copies the `static_template` object through:\n\n```\n# spec -> generated manifest (functions[].capabilities.response_semantics)\nx-ai-adaptive-card: {title: T, data_path: $.x,\n file: \"../../../../../../etc/passwd\"} -> static_template.file = \"../../../../../../etc/passwd\" (CWE-22)\nx-ai-capabilities.response_semantics.static_template:\n {file: \"../../../../../../etc/passwd\"} -> static_template.file = \"../../../../../../etc/passwd\" (CWE-22)\n```\n\n(`x-ai-adaptive-card.file` only reaches the manifest when `title` is set, so `GetResponseSemanticsFromAdaptiveCardExtension` fires; otherwise kiota writes its own template card instead.)\n\n### Impact\n\n**This is not local code execution on the build host.** The injected path is written into the generated plugin manifest and realized **downstream**, when the plugin is packaged and sideloaded / deployed to an AI host (Microsoft 365 Copilot / Teams) that resolves `static_template.file` relative to the plugin package (out-of-package file reference via `../`). Kiota is the propagation point: it fails to reject `../` and absolute paths in this provider-supplied field before writing it into the manifest.\n\n### Patches\n\nFixed in **1.32.5** (https://github.com/microsoft/kiota/pull/7892). `static_template.file` from both `x-ai-adaptive-card` and `x-ai-capabilities` is validated as a relative path confined to the plugin output package: absolute URIs, rooted/UNC paths, Windows drive paths, and `..` traversal segments are rejected, and unsafe references are dropped with a warning. Regression tests cover `..`, absolute paths, and URI values.\n\n### Remediation\n\nUpgrade to Kiota **1.32.5** or later and regenerate affected plugins.",
"severity": [
{
"type": "CVSS_V4",
Expand Down Expand Up @@ -56,7 +56,7 @@
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota"
"name": "Microsoft.OpenApi.Kiota.Builder"
},
"ranges": [
{
Expand All @@ -75,7 +75,7 @@
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota.Builder"
"name": "Microsoft.OpenApi.Kiota"
},
"ranges": [
{
Expand Down
Loading