Multiple security vulnerabilities have been identified in Microsoft Kiota, affecting the nuget/Microsoft.OpenApi.Kiota and nuget/Microsoft.OpenApi.Kiota.Builder packages. These issues involve multiple code injection types within the C#, Ruby, Python, and PHP code generators that allow attackers to break out of comment contexts or inject malicious literals. The business impact is severe, as processing untrusted or compromised OpenAPI descriptions can lead to arbitrary code execution during client generation or build processes, potentially compromising developer environments and CI/CD pipelines.
CVE-2026-59860 (CVSS 8.7 — High): A code-generation injection vulnerability in Microsoft Kiota allows a malicious OpenAPI specification to inject arbitrary CSharp code into generated clients by exploiting unsanitized XML documentation comments.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Microsoft Kiota, affecting the nuget/Microsoft.OpenApi.Kiota and nuget/Microsoft.OpenApi.Kiota.Builder packages. These issues involve multiple code injection types within the C#, Ruby, Python, and PHP code generators that allow attackers to break out of comment contexts or inject malicious literals. The business impact is severe, as processing untrusted or compromised OpenAPI descriptions can lead to arbitrary code execution during client generation or build processes, potentially compromising developer environments and CI/CD pipelines.
CVE-2026-59860 (CVSS 8.7 — High): A code-generation injection vulnerability in Microsoft Kiota allows a malicious OpenAPI specification to inject arbitrary CSharp code into generated clients by exploiting unsanitized XML documentation comments.[emaillocker id="1283"]
CVE-2026-59861 (CVSS 7.5 — High): A code-generation literal injection vulnerability in Microsoft Kiota Ruby Generator allows a malicious OpenAPI specification to inject arbitrary Ruby code into generated model classes through improperly escaped string literals.
CVE-2026-59862 (CVSS 7.5 — High): A code-generation injection vulnerability in Microsoft Kiota Python Generator allows a malicious OpenAPI specification to inject arbitrary Python code into generated modules through unsanitized enum descriptions that execute when the generated code is imported.
CVE-2026-59859 (CVSS 8.7 — High): A code-generation literal injection vulnerability in Microsoft Kiota PHP Generator allows a malicious OpenAPI specification to inject arbitrary PHP code into generated clients through improperly escaped string literals containing PHP variable interpolation sequences.
CVE-2026-59864 (CVSS 9.3 — Critical): A path traversal vulnerability exists when generating the Copilot plugin manifest via x-ai-* extensions in Microsoft Kiota, allowing an attacker-controlled or compromised OpenAPI description to embed a../ / absolute path into the manifest's response_semantics.static_template.file.
CVE-2026-59867 (CVSS 7.1 — High): The shared SanitizeDoubleQuote function in does not escape the $ character, preserving $-prefixed interpolation constructs verbatim in PHP double-quoted literals generated from OpenAPI specifications.
CVE-2026-59863 (CVSS 7.0 — High): A path traversal vulnerability in Microsoft Kiota allows a malicious .kiota/workspace.json configuration to write generated client files to arbitrary locations outside the intended workspace.
CVE-2026-59865 (CVSS 9.3 — Critical): A command injection vulnerability in Microsoft Kiota allows a malicious OpenAPI specification to supply attacker-controlled dependency installation commands that can execute arbitrary shell commands on developer or CI environments.
CVE-2026-59866: (CVSS 7.0 — High) A client name and namespace injection vulnerability in Microsoft Kiota allows a malicious OpenAPI specification to manipulate generated file paths and inject invalid content into generated client declarations through unsanitized clientClassName and clientNamespaceName values.
The following reports contain further technical details:
[/emaillocker]