PT-2026-60479
CVE-2026-59860
·
Published
2026-07-16
·
Updated
2026-08-17
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Kiota versions prior to 1.29.1
Kiota versions 1.30.0 through 1.32.2
Description
Kiota, an OpenAPI based HTTP Client code generator, contains a code-generation injection flaw in the C# XML documentation-comment sink. The issue occurs when text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters. This allows an attacker to break out of the
/// comment line and inject arbitrary code into the generated C# clients via the description, externalDocs label, and externalDocs link fields. The injected code is executed when the developer or CI system builds the generated client. This is practically exploitable if the OpenAPI description is from an untrusted source or has been tampered with.Recommendations
Update Kiota to version 1.29.1 or later.
Update Kiota to version 1.32.3 or later.
Regenerate existing clients to replace vulnerable code with hardened output.
Found an issue in the description? Have something to add? Feel free to write us 👾