{"action":"Upgrade Microsoft.OpenApi.Kiota to 1.29.1 (1.29.x) or 1.34.0 (1.34.x) or later.","affected":[{"fixed":"1.34.0","introduced":"1.30.0"},{"fixed":"1.29.1","introduced":"0"}],"component":"Microsoft.OpenApi.Kiota","cve_ids":["CVE-2026-73851"],"ecosystem":"NuGet","epss":0.02275,"exploited":false,"fixed_versions":["1.34.0","1.29.1"],"ghsa_id":"GHSA-p5rm-jg5c-8c77","id":"tcs_01M5N8VWNNCAVZW33TSQTN03Q0","modified_at":"2026-08-17T15:25:59.758241Z","published_at":"2026-07-24T16:14:56Z","references":["https://osv.dev/vulnerability/GHSA-p5rm-jg5c-8c77","https://github.com/microsoft/kiota/security/advisories/GHSA-p5rm-jg5c-8c77","https://github.com/microsoft/kiota/issues/7912","https://github.com/microsoft/kiota/pull/7910","https://github.com/microsoft/kiota/pull/7913","https://github.com/microsoft/kiota/commit/430008e9d700b3fe80f206c672415cfbd8e830e7","https://github.com/microsoft/kiota/commit/de3d18d9fe31ced4ac749728d3a2f94811f59268","https://github.com/microsoft/kiota","https://github.com/microsoft/kiota/releases/tag/v1.34.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-p5rm-jg5c-8c77","url":"https://osv.dev/vulnerability/GHSA-p5rm-jg5c-8c77"},{"source":"nvd","source_id":"CVE-2026-73851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73851"}],"summary":"Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)"}