Kiota Fixes Path Traversal in Copilot Plugin Manifest Generation via x-ai-* Extensions

What happened

Microsoft disclosed a path traversal vulnerability (CWE-22/CWE-829, tracked as CVE-2026-59864) in Kiota, the OpenAPI-to-code/manifest generator used to build Microsoft 365 Copilot and Teams plugins. According to the GitHub Security Advisory, kiota plugin add / kiota plugin generate -t APIPlugin copies the static_template.file value from the x-ai-adaptive-card and x-ai-capabilities OpenAPI extensions verbatim into the generated plugin manifest (<name>-apiplugin.json), with no validation. An OpenAPI description containing a ../ sequence or an absolute path in that field is confirmed (on Kiota 1.32.4) to propagate straight through into the manifest's response_semantics.static_template.file.

Why it matters

The advisory is explicit that this is not code execution on the build host — Kiota itself just writes the tainted path into the manifest. The risk materializes downstream: if that manifest is packaged and sideloaded or deployed to an AI host (Copilot/Teams), the host resolves static_template.file relative to the plugin package, allowing an out-of-package file reference. Anyone generating Copilot/Teams plugins from an OpenAPI spec they don't fully control or trust — third-party specs, specs pulled from external repos, or specs modified by a compromised upstream — is exposed. Exploitation is currently rated as PoC-public.

What defenders should watch for

• Inventory where Kiota is used to generate API plugins from OpenAPI/AI-plugin extension definitions, especially in CI/CD pipelines that consume third-party or externally-sourced specs.
• Treat OpenAPI descriptions as untrusted input if their origin isn't fully controlled — review x-ai-adaptive-card and x-ai-capabilities blocks for ../, absolute paths, drive letters, or UNC-style paths before generation.
• Audit already-generated *-apiplugin.json manifests for suspicious or out-of-package static_template.file values.
• Confirm the version of Kiota in use across build environments and plugin-generation tooling; check deployed Copilot/Teams plugin packages for unexpected file references outside the package root.

What to do now

Upgrade to Kiota 1.32.5 or later, which validates static_template.file as a package-relative path and rejects absolute URIs, rooted/UNC/drive paths, and .. traversal. Regenerate any plugins that were built with an affected version before upgrading.

This is fresh, same-day intel from a GitHub Security Advisory and details may evolve as the fix and CVE record mature. Full technical writeup: GHSA-4jwf-m4wg-8p66.