Unsafe Dependency Resolution Affecting microsoft.openapi.kiota.builder package, versions [,1.34.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Unsafe Dependency Resolution vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-DOTNET-MICROSOFTOPENAPIKIOTABUILDER-18689765
- published12 Aug 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-22 (opens in a new tab)How to fix?
Upgrade Microsoft.OpenApi.Kiota.Builder to version 1.34.0 or higher.
Overview
Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the IsSafeFileReference function. An attacker can access or disclose files outside the intended package boundary by supplying a crafted percent-encoded or multi-encoded file reference in the OpenAPI description, which is then written into the generated manifest and resolved by the AI host. This can include traversal sequences, absolute paths, URIs, or encoded payloads that bypass validation checks.
Workaround
This vulnerability can be mitigated by only generating clients/plugins from trusted OpenAPI descriptions and reviewing generated plugin manifests before deployment to ensure the response_semantics.static_template.file value is a simple relative path within the adaptiveCards/ package folder (no .., no rooted/absolute paths, no URIs, no percent-encoded separators).