CVE-2026-59862

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/microsoft/kiota/releases/tag/v1.32.0
https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.0, el generador de Python de Kiota permitía que las descripciones de valores enumerados controladas por el atacante de x-ms-enum.values[].description fluyeran a través de KiotaBuilder.SetEnumOptions hacia Documentation.DescriptionTemplate y PythonConventionService.RemoveInvalidDescriptionCharacters sin saneamiento de nueva línea, permitiendo que los comentarios en línea generados se dividieran y ejecutaran código Python controlado por el atacante en el ámbito del módulo cuando se importaban los módulos generados. Este problema está solucionado en la versión 1.32.0.

Information

Published : 2026-07-16 15:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-59862

Mitre link : CVE-2026-59862

CVE.ORG link : CVE-2026-59862

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-59862", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59862", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:36.677843Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}]}], "published": "2026-07-16T15:16:35.570", "references": [{"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-7f3j-j7jj-r3vr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.0, el generador de Python de Kiota permit\u00eda que las descripciones de valores enumerados controladas por el atacante de x-ms-enum.values[].description fluyeran a trav\u00e9s de KiotaBuilder.SetEnumOptions hacia Documentation.DescriptionTemplate y PythonConventionService.RemoveInvalidDescriptionCharacters sin saneamiento de nueva l\u00ednea, permitiendo que los comentarios en l\u00ednea generados se dividieran y ejecutaran c\u00f3digo Python controlado por el atacante en el \u00e1mbito del m\u00f3dulo cuando se importaban los m\u00f3dulos generados. Este problema est\u00e1 solucionado en la versi\u00f3n 1.32.0."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}