The vulnerability in Microsoft Kiota (CVE-2026-59865) involves improper control of code generation (CWE-94) where the 'kiota info' command reads the 'dependencyInstallCommand' from the 'x-ms-kiota-info' extension in an OpenAPI description and presents it as the recommended install command. An attacker-controlled or compromised OpenAPI spec can supply a malicious shell command, which developers might execute, resulting in remote code execution (RCE). The Kiota VS Code extension also exposes this command in its JSON output and can run it automatically, increasing risk. This vulnerability affects Kiota versions prior to 1.32.5. The fix, introduced in versions 1.29.1 and 1.32.5, removes support for spec-supplied install commands, ensuring only Kiota's trusted package-manager commands are used.

If a developer runs 'kiota info' on a malicious or compromised OpenAPI description and follows the suggested install command, they may execute arbitrary shell commands on their workstation or CI environment, leading to remote code execution. The Kiota VS Code extension can automatically run the malicious command, increasing the risk of exploitation. This vulnerability requires the OpenAPI description to be attacker-controlled or tampered with and the developer to run the suggested command. The impact is critical due to the potential for full code execution without user privileges or interaction beyond running the suggested command.

Upgrade Microsoft Kiota to version 1.29.1, 1.32.5, or later. Also update the Kiota VS Code extension to a version built against Kiota 1.32.5 or newer. These updates remove support for spec-supplied install commands, eliminating the vulnerability. Do not run install commands suggested by untrusted OpenAPI descriptions. Patch status is confirmed fixed in these versions.