CVE-2026-59862

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.0

Description Kiota is an OpenAPI based HTTP Client code generator. The Python generator fails to sanitize newlines in enum value descriptions provided via x-ms-enum.values[].description. This data flows through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters. Consequently, an attacker can inject malicious content into generated inline comments, allowing the execution of arbitrary Python code at the module scope when the generated modules are imported.

Recommendations Update to version 1.32.0.