Detections
Analytics

SCA: security update for kiota (GHSA-2hx3-vp6r-mg3f)

high Tenable Self-Hosted Container Security Plugin ID 440390

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.31.1 are affected by a code-
 generation literal injection vulnerability in multiple writer sinks (for example:
 serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property
 metadata, and default value emission). When malicious values from an OpenAPI description are emitted into
 generated source without context-appropriate escaping, an attacker can break out of string literals and
 inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI
 description used for generation is from an untrusted source, or a normally trusted OpenAPI description has
 been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions
 significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.31.1 or later and
 regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures
 previously generated vulnerable code is replaced with hardened output. (CVE-2026-41134)

Solution

Update the kiota library and its related packages to version 1.31.1 or later.

See Also

https://github.com/advisories/GHSA-2hx3-vp6r-mg3f

Plugin Details

Severity: High

ID: 440390

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 4/15/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.96

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-41134

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.3

Threat Score: 6.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-41134

cwe: CWE-94