TI-2026-42676 Aliases CVE-2026-59861 GHSA-xg2h-5xr2-29jw

Kiota: Code Generation Literal Injection in Kiota Ruby Generator

MEDIUM 45CWE-94Published 2026-07-16 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02048 81st percentileScored 2026-11-07

Fix Fixed kiota (microsoft): 1.31.1, 1.29.1Microsoft.OpenAPI.Kiota (NuGet): 1.32.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	kiota	1.30.0 to before 1.31.1; before 1.29.1	1.31.1, 1.29.1	Patch available	CNA
—	Microsoft.OpenAPI.Kiota (NuGet)	1.30.0 to before 1.32.0	1.32.0	Patch available	GHSA-xg2h-5xr2-29jw
—	Microsoft.OpenAPI.Kiota.Builder (NuGet)	1.30.0 to before 1.32.0	1.32.0	Patch available	GHSA-xg2h-5xr2-29jw
—	Microsoft.OpenApi.Kiota (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-xg2h-5xr2-29jw
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-xg2h-5xr2-29jw

kiota VendorMicrosoft Affected 1.30.0 to before 1.31.1; before 1.29.1 Fixed in 1.31.1, 1.29.1 Patch available CNA
Microsoft.OpenAPI.Kiota (NuGet) Vendor— Affected 1.30.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-xg2h-5xr2-29jw
Microsoft.OpenAPI.Kiota.Builder (NuGet) Vendor— Affected 1.30.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-xg2h-5xr2-29jw
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-xg2h-5xr2-29jw
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-xg2h-5xr2-29jw

Remediation

Fix · CNA kiota (microsoft) Fixed in 1.31.1, 1.29.1
Fix · GHSA-xg2h-5xr2-29jw Microsoft.OpenAPI.Kiota (NuGet) Fixed in 1.32.0 Advisory →
Fix · GHSA-xg2h-5xr2-29jw Microsoft.OpenAPI.Kiota.Builder (NuGet) Fixed in 1.32.0 Advisory →
Fix · GHSA-xg2h-5xr2-29jw Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.29.1 Advisory →
Fix · GHSA-xg2h-5xr2-29jw Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.29.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59861
2026-10-03 Alias added: GHSA-xg2h-5xr2-29jw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59861

Other 5

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences