CVE-2026-59859

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87
https://github.com/microsoft/kiota/pull/7863
https://github.com/microsoft/kiota/releases/tag/v1.32.4
https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.4, el generador PHP de Kiota incrustaba la descripción de OpenAPI, campos predeterminados, nombres de propiedades y otras cadenas derivadas del esquema en literales PHP entre comillas dobles a través de SanitizeDoubleQuote() en Writers/StringExtensions.cs sin escapar $, permitiendo que construcciones de interpolación controladas por el atacante como ${...}, $var, o {$obj -> prop} inyectaran código PHP arbitrario en las clases de modelo y de constructor de solicitudes generadas. Este problema está solucionado en la versión 1.32.4.

Information

Published : 2026-07-16 15:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59859

Mitre link : CVE-2026-59859

CVE.ORG link : CVE-2026-59859

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-59859", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59859", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:37.664979Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-07-16T15:16:35.167", "references": [{"url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7863", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.4, el generador PHP de Kiota incrustaba la descripci\u00f3n de OpenAPI, campos predeterminados, nombres de propiedades y otras cadenas derivadas del esquema en literales PHP entre comillas dobles a trav\u00e9s de SanitizeDoubleQuote() en Writers/StringExtensions.cs sin escapar $, permitiendo que construcciones de interpolaci\u00f3n controladas por el atacante como ${...}, $var, o {$obj -> prop} inyectaran c\u00f3digo PHP arbitrario en las clases de modelo y de constructor de solicitudes generadas. Este problema est\u00e1 solucionado en la versi\u00f3n 1.32.4."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}