TI-2026-42674 Aliases CVE-2026-59859 GHSA-jqwh-526h-c92j

Kiota: Code Generation Literal Injection in the PHP Generator

MEDIUM 42CWE-94Published 2026-07-16 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01381 72nd percentileScored 2026-11-07

Fix Fixed kiota (microsoft): 1.31.1, 1.29.1Microsoft.OpenApi.Kiota (NuGet): 1.32.4, 1.29.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	kiota	1.30.0 to before 1.31.1; before 1.29.1	1.31.1, 1.29.1	Patch available	CNA
—	Microsoft.OpenApi.Kiota (NuGet)	1.30.0 to before 1.32.4	1.32.4	Patch available	GHSA-jqwh-526h-c92j
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	1.30.0 to before 1.32.4	1.32.4	Patch available	GHSA-jqwh-526h-c92j
—	Microsoft.OpenApi.Kiota (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-jqwh-526h-c92j
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-jqwh-526h-c92j

kiota VendorMicrosoft Affected 1.30.0 to before 1.31.1; before 1.29.1 Fixed in 1.31.1, 1.29.1 Patch available CNA
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected 1.30.0 to before 1.32.4 Fixed in 1.32.4 Patch available GHSA-jqwh-526h-c92j
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected 1.30.0 to before 1.32.4 Fixed in 1.32.4 Patch available GHSA-jqwh-526h-c92j
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-jqwh-526h-c92j
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-jqwh-526h-c92j

Remediation

Fix · CNA kiota (microsoft) Fixed in 1.31.1, 1.29.1
Fix · GHSA-jqwh-526h-c92j Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.32.4 Advisory →
Fix · GHSA-jqwh-526h-c92j Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.32.4 Advisory →
Fix · GHSA-jqwh-526h-c92j Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.29.1 Advisory →
Fix · GHSA-jqwh-526h-c92j Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.29.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59859
2026-10-03 Alias added: GHSA-jqwh-526h-c92j

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59859

Other 5

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences