CVE-2026-59860

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions 1.30.0 through 1.32.2

Description Kiota, an OpenAPI based HTTP Client code generator, contains a code-generation injection flaw in the C# XML documentation-comment sink. The issue occurs when text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters. This allows an attacker to break out of the /// comment line and inject arbitrary code into the generated C# clients via the description, externalDocs label, and externalDocs link fields. The injected code is executed when the developer or CI system builds the generated client. This is practically exploitable if the OpenAPI description is from an untrusted source or has been tampered with.

Recommendations Update Kiota to version 1.29.1 or later. Update Kiota to version 1.32.3 or later. Regenerate existing clients to replace vulnerable code with hardened output.