Kiota is an OpenAPI‑based HTTP client generator that, before version 1.32.5, did not validate the output path values defined in a .kiota/workspace.json configuration file. The vulnerability allows a poisoned workspace configuration to contain absolute, UNC, drive‑letter, or traversal paths, enabling Kiota to write generated client files anywhere on the host during the generation process. An attacker who can influence the workspace configuration—such as by submitting a malicious repository or pull request—could overwrite system files, inject malicious code, or create files that later execute, creating a serious compromise vector.

All installations of Microsoft Kiota using versions prior to 1.32.5 are affected. The flaw surfaces whenever the kiota client generate or kiota plugin generate commands are run against a workspace.json that is not properly sanitized, regardless of platform. Any environment that executes Kiota as part of a CI pipeline or local development workflow is therefore at risk.

The CVSS score of 7 indicates high severity. The EPSS score of 1% indicates a small but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve embedding a malicious workspace configuration in a repository or pull request so that when a developer or CI system runs Kiota, it writes files outside the intended directory; this could lead to privilege escalation or remote code execution if the generated files are later executed as part of a build or runtime process.