Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-59861Kiota: Code Generation Literal Injection in Kiota Ruby Generator

High 7.5

In plain English

A high-severity code injection in kiota from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.0%top 18.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	microsoft.openapi.kiota	1.32.0	GHSA-xg2h-5xr2-29jw
NuGet	microsoft.openapi.kiota	1.29.1	GHSA-xg2h-5xr2-29jw
NuGet	microsoft.openapi.kiota.builder	1.32.0	GHSA-xg2h-5xr2-29jw
NuGet	microsoft.openapi.kiota.builder	1.29.1	GHSA-xg2h-5xr2-29jw

Affected products (as reported)

Vendor	Product	Versions
microsoft	kiota	>= 1.30.0, < 1.31.1< 1.29.1

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw x_refsource_CONFIRM
https://github.com/microsoft/kiota/pull/7746 x_refsource_MISC
https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6 x_refsource_MISC
https://github.com/microsoft/kiota/releases/tag/v1.32.0 x_refsource_MISC