TI-2026-42677 Aliases CVE-2026-59862 GHSA-7f3j-j7jj-r3vr

Kiota: Code Generation Literal Injection in the Python Generator

MEDIUM 44CWE-94Published 2026-07-16 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01376 72nd percentileScored 2026-11-07

Fix Fixed kiota (microsoft): 1.31.1, 1.29.1Microsoft.OpenAPI.Kiota (NuGet): 1.32.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	kiota	1.30.0 to before 1.31.1; before 1.29.1	1.31.1, 1.29.1	Patch available	CNA
—	Microsoft.OpenAPI.Kiota (NuGet)	1.30.0 to before 1.32.0	1.32.0	Patch available	GHSA-7f3j-j7jj-r3vr
—	Microsoft.OpenAPI.Kiota.Builder (NuGet)	1.30.0 to before 1.32.0	1.32.0	Patch available	GHSA-7f3j-j7jj-r3vr
—	Microsoft.OpenApi.Kiota (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-7f3j-j7jj-r3vr
—	Microsoft.OpenApi.Kiota.Builder (NuGet)	before 1.29.1	1.29.1	Patch available	GHSA-7f3j-j7jj-r3vr

kiota VendorMicrosoft Affected 1.30.0 to before 1.31.1; before 1.29.1 Fixed in 1.31.1, 1.29.1 Patch available CNA
Microsoft.OpenAPI.Kiota (NuGet) Vendor— Affected 1.30.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-7f3j-j7jj-r3vr
Microsoft.OpenAPI.Kiota.Builder (NuGet) Vendor— Affected 1.30.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-7f3j-j7jj-r3vr
Microsoft.OpenApi.Kiota (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-7f3j-j7jj-r3vr
Microsoft.OpenApi.Kiota.Builder (NuGet) Vendor— Affected before 1.29.1 Fixed in 1.29.1 Patch available GHSA-7f3j-j7jj-r3vr

Remediation

Fix · CNA kiota (microsoft) Fixed in 1.31.1, 1.29.1
Fix · GHSA-7f3j-j7jj-r3vr Microsoft.OpenAPI.Kiota (NuGet) Fixed in 1.32.0 Advisory →
Fix · GHSA-7f3j-j7jj-r3vr Microsoft.OpenAPI.Kiota.Builder (NuGet) Fixed in 1.32.0 Advisory →
Fix · GHSA-7f3j-j7jj-r3vr Microsoft.OpenApi.Kiota (NuGet) Fixed in 1.29.1 Advisory →
Fix · GHSA-7f3j-j7jj-r3vr Microsoft.OpenApi.Kiota.Builder (NuGet) Fixed in 1.29.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59862
2026-10-03 Alias added: GHSA-7f3j-j7jj-r3vr

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59862

Other 3

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences