Is Microsoft.OpenApi.Kiota.Builder safe?

GHSA-4jwf-m4wg-8p66

kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled statictemplate.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's responsesemantics.statictemplate.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the AI host when the generated plugin is deployed.

Confirmed on Kiota 1.32.4 (KIOTACONFIGPREVIEW=true, the self-contained linux-x64 release binary).

Both extension paths write the statictemplate.file reference straight into the manifest without sanitization — PluginsGenerationService.GetResponseSemanticsFromAdaptiveCardExtension mints statictemplate = {"file": }, and the x-ai-capabilities path copies the statictemplate object through:

# spec                                                  -> generated manifest (functions[].capabilities.response_semantics)
x-ai-adaptive-card: {title: T, data_path: $.x,
   file: "../../../../../../etc/passwd"}                -> static_template.file = "../../../../../../etc/passwd"   (CWE-22)
x-ai-capabilities.response_semantics.static_template:
   {file: "../../../../../../etc/passwd"}               -> static_template.file = "../../../../../../etc/passwd"   (CWE-22)

(x-ai-adaptive-card.file only reaches the manifest when title is set, so GetResponseSemanticsFromAdaptiveCardExtension fires; otherwise kiota writes its own template card instead.)

This is not local code execution on the build host. The injected path is written into the generated plugin manifest and realized downstream, when the plugin is packaged and sideloaded / deployed to an AI host (Microsoft 365 Copilot / Teams) that resolves statictemplate.file relative to the plugin package (out-of-package file reference via ../). Kiota is the propagation point: it fails to reject ../ and absolute paths in this provider-supplied field before writing it into the manifest.

Fixed in 1.29.1 and 1.32.5 (https://github.com/microsoft/kiota/pull/7892). statictemplate.file from both x-ai-adaptive-card and x-ai-capabilities is validated as a relative path confined to the plugin output package: absolute URIs, rooted/UNC paths, Windows drive paths, and .. traversal segments are rejected, and unsafe references are dropped with a warning. Regression tests cover .., absolute paths, and URI values.

Upgrade to Kiota 1.29.1, 1.32.5 or later and regenerate affected plugins.