CVE-2026-59861

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.0

Description The Ruby generator in Kiota fails to properly escape the # character when embedding OpenAPI default fields, property names, and other schema-derived strings into Ruby double-quoted literals. This occurs within CodeMethodWriter.cs and the SanitizeForQuotedLiteral() function in Writers/StringExtensions.cs. An attacker can use interpolation markers such as #{expr}, #$var, or #@var to inject arbitrary Ruby code into the generated model classes.

Recommendations Update to version 1.32.0.