The vulnerability in Microsoft Kiota (CVE-2026-59864) involves improper limitation of a pathname to a restricted directory (CWE-22) combined with out-of-package file inclusion (CWE-829). The kiota plugin commands 'kiota plugin add' and 'kiota plugin generate' with '-t APIPlugin' emit the 'static_template.file' path from AI-plugin extensions verbatim into the plugin manifest without sanitization. An attacker-controlled OpenAPI description can embed path traversal sequences or absolute paths into the manifest's 'response_semantics.static_template.file' field. This path is later resolved by the AI host (Microsoft 365 Copilot / Teams) when the plugin is deployed, potentially allowing access to files outside the plugin package. The vulnerability was confirmed in Kiota version 1.32.4 with the self-contained linux-x64 binary. The issue is not local code execution on the build host but occurs downstream during plugin deployment. The fix, introduced in versions 1.29.1 and 1.32.5, validates and restricts 'static_template.file' to relative paths confined to the plugin package, rejecting absolute paths, UNC paths, Windows drive paths, and traversal segments.

The vulnerability allows an attacker to cause the AI host environment (Microsoft 365 Copilot / Teams) to resolve and include files outside the intended plugin package via crafted path traversal or absolute paths in the plugin manifest. This can lead to unauthorized file access or disclosure when the plugin is deployed and executed by the AI host. There is no direct local code execution on the build host; the impact manifests downstream in the AI host environment. The CVSS 4.0 score is 9.3 (critical), reflecting high impact with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Microsoft Kiota to version 1.29.1, 1.32.5, or later. These versions include validation that restricts 'static_template.file' paths to relative paths within the plugin package and reject unsafe paths such as absolute paths and traversal segments. Regenerate any affected plugins after upgrading. No additional mitigation is required as the fix addresses the root cause by sanitizing the path input before manifest generation.