CVE-2026-59861

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6
https://github.com/microsoft/kiota/pull/7746
https://github.com/microsoft/kiota/releases/tag/v1.32.0
https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.0, el generador Ruby de Kiota incrustaba campos predeterminados de OpenAPI, nombres de propiedades y otras cadenas derivadas del esquema a través de CodeMethodWriter.cs y SanitizeForQuotedLiteral() en Writers/StringExtensions.cs en literales de Ruby entre comillas dobles sin escapar #, permitiendo que los marcadores de interpolación #{expr}, #$var o #@var controlados por el atacante inyectaran código Ruby arbitrario en las clases de modelo generadas. Este problema se corrigió en la versión 1.32.0.

Information

Published : 2026-07-16 15:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59861

Mitre link : CVE-2026-59861

CVE.ORG link : CVE-2026-59861

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-59861", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59861", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:35.781411Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-07-16T15:16:35.440", "references": [{"url": "https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/pull/7746", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.0, el generador Ruby de Kiota incrustaba campos predeterminados de OpenAPI, nombres de propiedades y otras cadenas derivadas del esquema a trav\u00e9s de CodeMethodWriter.cs y SanitizeForQuotedLiteral() en Writers/StringExtensions.cs en literales de Ruby entre comillas dobles sin escapar #, permitiendo que los marcadores de interpolaci\u00f3n #{expr}, #$var o #@var controlados por el atacante inyectaran c\u00f3digo Ruby arbitrario en las clases de modelo generadas. Este problema se corrigi\u00f3 en la versi\u00f3n 1.32.0."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}