# Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

Kiota emitted x-ms-kiota-info clientClassName/clientNamespaceName unsanitized into output file paths and class declarations, enabling arbitrary file write outside -o and code injection.

- Payout: Research
- Severity: high
- Program: Microsoft
- Found by: Gal3m, mrostamipoor
- Disclosed: 2026-07-24
- CVE: CVE-2026-59866
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-4vv7-jj25-4gh6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-4vv7-jj25-4gh6
- Tags: area:oss domain:oss impact:dos impact:integrity kind:research platform:ghsa sev:high tech:dotnet technique:incomplete-fix technique:source-review vuln:path-traversal

**Target:** Kiota code generator (kiota generate) consuming OpenAPI descriptions
**Root cause:** Provider-supplied clientClassName/clientNamespaceName from the x-ms-kiota-info extension were used raw as both the generated class/namespace identifier and part of the output file path, with no sanitization.
**Steps:**
1. Craft an OpenAPI description containing x-ms-kiota-info with clientClassName set to an absolute path, e.g. `/var/www/html/shell`.
2. Run `kiota generate` without `-c/--class-name` so the extension value is used.
3. Observe the generated source file written to `/var/www/html/shell.cs`, outside the `-o` output directory.
4. Alternatively set clientClassName to `Pwn { } public class INJECTED { } public partial class RealClient` to inject text into the generated class declaration.
**How found:** Researcher noted the earlier writer-sink hardening escaped property/enum/default/serialization sinks but never sanitized the provider-supplied clientClassName/clientNamespaceName, then traced those values into the filename and class-declaration sinks across C#, Java, Go, TypeScript, Python and PHP generators.
**Exploitation:** Attacker controls or tampers with an OpenAPI description consumed by a developer or CI host running zero-config `kiota generate`; the raw clientClassName flows into the output filename, writing a generated source file at an attacker-chosen path (e.g. webroot), and into the class declaration, corrupting the generated client.
**Insight:** When a generator hardens data-derived sinks, check provider-supplied metadata extensions (like x-ms-kiota-info) that feed both identifiers and output paths — they bypass the data-sink escaping entirely.

## Proof of concept (copied exactly from the original report)

**clientClassName path traversal payload**

```
clientClassName: "/abs/path/PWNED"   ->   /abs/path/PWNED.cs   (written outside -o)
```

**clientClassName code injection payload**

```
clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient'
   ->  public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }
```