High severity · published Jul 16, 2026
CVE-2026-59861
Kiota: Code Generation Literal Injection in Kiota Ruby Generator
7.5
CVSS
2%
EPSS
No
On KEV
Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kiota · microsoft
>= 1.30.0, < 1.31.1; < 1.29.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59861
github.com
https://github.com/microsoft/kiota/commit/fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6
github.com
https://github.com/microsoft/kiota/pull/7746
github.com
https://github.com/microsoft/kiota/releases/tag/v1.32.0
github.com
https://github.com/microsoft/kiota/security/advisories/GHSA-xg2h-5xr2-29jw
More from kiota
9.3
CVE-2026-59866
Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
9.3
CVE-2026-59864
Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
9.3
CVE-2026-59865
Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
8.8
CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
8.7
CVE-2026-59859
Kiota: Code Generation Literal Injection in the PHP Generator