Kiota is an OpenAPI based HTTP client generator that, prior to releases 1.29.1 and 1.32.5, resolved $ref references by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths during code generation. This behavior allowed an attacker to supply a malicious or attacker-controlled OpenAPI specification to the \"kiota generate\" process, leading to build-time server side request forgery and remote or local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or exposing leaks into generated clients. The issue is classified under CWE-22 (Absolute Path Traversal), CWE-829 (Code Signing Verification), and CWE-918 (Server Side Request Forgery).

Microsoft Kiota versions before 1.32.5 are vulnerable. The fix is delivered in commit cccd798027f0a20db796b3df6c64f9897a39d7b1 and published in release v1.32.5.

The CVSS score of 7.1 denotes high severity. The EPSS score of 2% indicates that the exploit probability is low but non‑zero. The vulnerability is not listed in CISA KEV. The attack vector is build-time; an attacker can trigger the flaw by inserting a malicious OpenAPI definition into a trusted build or CI environment. Successful exploitation can lead to arbitrary code execution on the machine that runs the generator, or to the extraction or tampering of files on that system.