Kiota, an OpenAPI‑based HTTP client code generator, can emit the static_template.file field of a Microsoft 365 Copilot or Teams plugin manifest from values supplied in x‑ai‑adaptive‑card and x‑ai‑capabilities extensions. Because the generator does not validate these paths, an attacker can supply an OpenAPI document that contains relative fragments such as "../", absolute file system paths, UNC shares, Windows drive letters, or URI schemes. When the plugin is generated, these values are written verbatim into response_semantics.static_template.file. The resulting manifest may reference files outside the intended package or point to arbitrary system files, potentially exposing sensitive data or, if the referenced file contains executable code, enabling code execution when the plugin is loaded by a user.

The vulnerability affects Microsoft Kiota versions earlier than 1.32.5. The flaw is triggered when running the "kiota plugin add" or "kiota plugin generate" commands with the "-t APIPlugin" option to produce Copilot or Teams plugin manifests. The issue originates from the inclusion of x‑ai‑adaptive‑card and x‑ai‑capabilities extensions in the OpenAPI specification that are copied into the manifest without proper path validation.

With a CVSS score of 9.3 the flaw is considered high severity. The EPSS score of 1% indicates a very low but non‑zero likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack vector is local; an adversary must supply a malicious OpenAPI document to the generation workflow. Once the plugin is deployed, an attacker can exploit path traversal or arbitrary file inclusion to read or execute code within the hosting environment.