How severe is GHSA-p5rm-jg5c-8c77?

No CVSS score has been assigned to GHSA-p5rm-jg5c-8c77 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-p5rm-jg5c-8c77?

GHSA-p5rm-jg5c-8c77 affects the following packages: Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota (NuGet). Ecosystems affected: NuGet.

How do I fix GHSA-p5rm-jg5c-8c77?

Update Microsoft.OpenApi.Kiota to 1.34.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p5rm-jg5c-8c77 is resolved across your whole dependency graph.

How do I detect GHSA-p5rm-jg5c-8c77 in my NuGet dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.OpenApi.Kiota, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-p5rm-jg5c-8c77 if there is no patch (or I can't update yet)?

Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Is GHSA-p5rm-jg5c-8c77 actively exploited in the wild?

No public exploit code has been indexed for GHSA-p5rm-jg5c-8c77 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for GHSA-p5rm-jg5c-8c77?

GHSA-p5rm-jg5c-8c77 has an EPSS (Exploit Prediction Scoring System) score of 2.3%, placing it in the 82th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is GHSA-p5rm-jg5c-8c77?

GHSA-p5rm-jg5c-8c77 is classified as Path Traversal (CWE-22), CWE-829 (CWE-829). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was GHSA-p5rm-jg5c-8c77 published, and has it been updated?

GHSA-p5rm-jg5c-8c77 was published on July 24, 2026 and was last updated on August 17, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

.NET NuGet

Not in CISA KEV

GHSA-p5rm-jg5c-8c77 — Microsoft.OpenApi.Kiota

Fix: microsoft/kiota#7910

GHSA-p5rm-jg5c-8c77 is a Path Traversal vulnerability in Microsoft.OpenApi.Kiota. A fix is available for Microsoft.OpenApi.Kiota — see the affected versions and patch details below.

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Also known asCVE-2026-73851

Published

Jul 24, 2026

Updated

Aug 17, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Oct 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-p5rm-jg5c-8c77.

EPSS Exploitation Probability

via FIRST.org ↗

2.3%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs82th percentile — riskier than 82% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

.NETMicrosoft.OpenApi.Kiota.NETMicrosoft.OpenApi.Kiota

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics static_template (or the adaptive-card extension x-ai-adaptive-card), the file reference is written into the generated manifest's response_semantics.static_template.file and is later resolved by the AI host relative to the plugin package.

An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary (CWE-22 Path Traversal, CWE-829 Inclusion of Functionality from an Untrusted Control Sphere).

A mitigation shipped in v1.32.5 (ExtensionResponseSemanticsStaticTemplate.IsSafeFileReference) rejected literal traversal, rooted paths, drive-qualified paths, and absolute URIs. However, that check inspected the raw reference string, so percent-encoded payloads bypassed every check and were still emitted verbatim. Examples that were incorrectly accepted as safe:

Input	Decodes to
`%2e%2e/card.json`	`../card.json`
`..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd`	`../../../../../../etc/passwd`
`file%3A%2F%2F%2Fetc%2Fpasswd`	`file:///etc/passwd`
`%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd`	`../../../etc/passwd`

Multi-level (double) encoding such as %252e%252e%252fcard.json was also affected. A follow-up review found additional residual bypasses of the same validator: an embedded NUL byte (%00) that truncated the path and defeated the parent-directory segment check, encoding nested deeper than the decode budget (which failed open), and Unicode full-width homoglyphs (e.g. %EF%BC%8E%EF%BC%8E → ．．).

Patches

The percent-encoding bypass is fixed by decoding the reference (bounded multi-pass) before validation: https://github.com/microsoft/kiota/pull/7910
Residual bypasses (NUL / control characters, decode-budget fail-open, Unicode homoglyphs) are fixed by failing closed on residual encoding, rejecting control characters, and NFKC-folding before validation: https://github.com/microsoft/kiota/pull/7913 (tracking issue https://github.com/microsoft/kiota/issues/7912)

Users should upgrade to the first released Microsoft.OpenApi.Kiota version that includes these fixes (the release following 1.33.0).

Workarounds

Only generate clients/plugins from trusted OpenAPI descriptions.
Review generated plugin manifests before deployment and reject any response_semantics.static_template.file value that is not a simple relative path within the adaptiveCards/ package folder (no .., no rooted/absolute paths, no URIs, no percent-encoded separators).

References

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-829: Inclusion of Functionality from an Untrusted Control Sphere
Affected code: src/Kiota.Builder/OpenApiExtensions/OpenApiAiCapabilitiesExtension.cs (IsSafeFileReference) and enforcement in src/Kiota.Builder/Plugins/PluginsGenerationService.cs.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
.NETNuGet	`Microsoft.OpenApi.Kiota`	≥ 1.30.0&&< 1.34.0	1.34.0`dotnet add package Microsoft.OpenApi.Kiota --version 1.34.0`
.NETNuGet	`Microsoft.OpenApi.Kiota`	all versions	1.29.1`dotnet add package Microsoft.OpenApi.Kiota --version 1.29.1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.OpenApi.Kiota, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.OpenApi.Kiota to 1.34.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p5rm-jg5c-8c77 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

### Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an `x-ai-capabilities` response semantics `static_template` (or the adaptive-card extension `x-ai-adaptive-card`), the `file` reference is written into the generated manifest's `response_semantics.static_template.file` and is later resolved by the AI host **relative to the plugin package**. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a `file` reference that resolves **outside** the manifest package (e.g. `../../../../etc/passwd`, an absol

O3 Security · Impact-Aware SCA

Is GHSA-p5rm-jg5c-8c77 in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works