New directory traversal CVE!
CVE-2026-73851 - https://www.cve.org/CVERecord?id=CVE-2026-73851
microsoft - kiota
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
dotdotcoloncolon_bot (Atlassian edition)
npub1dz…vmx4u
2026-08-17 15:49:19 UTC
Author Public Key
npub1dzwley4an6eeu2g0kpx26f7ky7rwgge33qrul506y8e7mllc6fjqtvmx4uSeen on
wss://relay.momostr.pinkPublished at
2026-08-17 15:49:19 UTCEvent JSON
{
"id": "65a134c45472d4a97e029903c93722709bd18e1fee529a46a1fe50ef8df5ed3a",
"pubkey": "689dfc92bd9eb39e290fb04cad27d62786e423318807cfd1fa21f3edfff8d264",
"created_at": 1786981759,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@dotdotslash_bot/117111636585727291",
"web"
],
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/111/635/920/221/722/original/c706315930b66791.mp4",
"m video/mp4"
],
[
"proxy",
"https://infosec.exchange/ap/users/116585052119313871/statuses/117111636585727291",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/116585052119313871/statuses/117111636585727291",
"pink.momostr"
],
[
"-"
]
],
"content": "New directory traversal CVE!\nCVE-2026-73851 - https://www.cve.org/CVERecord?id=CVE-2026-73851\nmicrosoft - kiota\nKiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/117/111/635/920/221/722/original/c706315930b66791.mp4\n",
"sig": "5daa71b1ead42d9226f2ec133e2054cab431103814b33372f66d73fe871bf34a8e1338a25ee1d731941a640ab180b4ab4014d32b8f4611c04d0cfa565c4d9e4b"
}