Kiota is an OpenAPI based HTTP client generator that, before version 1.32.5, resolved $ref references by fetching remote http(s) URLs and reading local absolute or out‑of‑tree file paths during code generation. This behaviour allowed an attacker to supply a malicious or attacker‑controlled OpenAPI specification to the "kiota generate" process, causing build‑time Server Side Request Forgery (SSRF) and remote or local file inclusion in the generated client code. The issue is categorized under CWE‑22 (Absolute Path Traversal), CWE‑829 (Code Signing Verification), and CWE‑918 (Server Side Request Forgery).

Microsoft Kiota versions before 1.32.5 are vulnerable. The fix is delivered in commit cccd798027f0a20db796b3df6c64f9897a39d7b1 and published in release v1.32.5.

The CVSS score of 7.1 denotes high severity. The EPSS score of 2% indicates that the exploit probability is low but non‑zero. The vulnerability is not listed in CISA KEV. The attack vector is build-time; an attacker can trigger the flaw by inserting a malicious OpenAPI definition into a trusted build or CI environment. Successful exploitation can lead to arbitrary code execution on the machine that runs the generator, or to the extraction or tampering of files on that system.