CVE-2026-59859

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions prior to 1.32.4

Description The PHP generator in Kiota is subject to a code generation literal injection. The SanitizeDoubleQuote() function in Writers/StringExtensions.cs fails to escape the $ character when embedding OpenAPI descriptions, default fields, property names, and other schema-derived strings into PHP double-quoted literals. This allows an attacker who controls an OpenAPI specification to use interpolation constructs such as ${...}, $var, or {$obj->prop} to inject arbitrary PHP code into the generated model and request-builder classes, which is then evaluated at runtime.

Recommendations Upgrade to version 1.29.1 or later. Upgrade to version 1.32.4 or later. Audit and sanitize OpenAPI specifications by removing or replacing strings containing the $ character before code generation. Implement mandatory code review of generated PHP files to identify double-quoted strings containing ${, $var, or {$ patterns. Restrict the consumption of OpenAPI specifications to trusted internal sources. Manually escape $ characters in double-quoted string literals within generated files by replacing $ with $.