The core engine behind the OpenAPI based client generator.
82%
Total Score
100
100
81
90
Neither a declared license nor a license file was found for the package, creating a genuine licensing and transparency gap for downstream users.
The package has a substantial history of 46 releases over 1,557 days, but it has had zero releases in the last 12 months; this is a maintenance concern, although the active repository provides compensating evidence.
The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent; the monorepo context makes a subpackage explanation plausible but does not eliminate the verification gap.
Seven workflows lack top-level permissions and four declare top-level write permissions, which weakens least-privilege transparency even though two workflows are read-only and some permissions are job-scoped.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-15873 Microsoft.OpenApi.Kiota.Builder is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4. | 0.0.1 - 1.32.4 | High |
AIKIDO-2026-687567 Microsoft.OpenApi.Kiota.Builder is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4. | 0.0.1 - 1.32.4 | Critical |
AIKIDO-2026-893593 Microsoft.OpenApi.Kiota.Builder is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4. | 0.0.1 - 1.32.4 | Critical |
AIKIDO-2026-117504 Microsoft.OpenApi.Kiota.Builder is vulnerable to Command Injection in versions 0.0.1 - 1.32.4. | 0.0.1 - 1.32.4 | Critical |
AIKIDO-2026-272541 Microsoft.OpenApi.Kiota.Builder is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 1.32.4. | 0.0.1 - 1.32.4 | High |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
asynckeyedlock Version [8.0.2, ) | — | — |
dotnet.glob Version [3.1.3, ) | — | — |
microsoft.declarativeagents.manifest Version [5.0.0-rc.2, ) | — | — |
microsoft.extensions.logging.abstractions Version [10.0.11, ) | — | — |
microsoft.kiota.bundle Version [2.0.0, ) | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.