{"id":"CVE-2026-41134","aliases":["GHSA-2hx3-vp6r-mg3f"],"url":"https://o3.security/vulnerability/CVE-2026-41134","summary":"Kiota: Code Generation Literal Injection","details":"# CVE Advisory (CVE-2026-41134): Code Generation Literal Injection in Kiota\n\n## Summary\n\nKiota versions **prior to 1.29.1 and 1.31.1** are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission).\n\nWhen malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients.\n\n## Impact and Preconditions\n\nThis issue is only practically exploitable when:\n\n1. the OpenAPI description used for generation is from an **untrusted source**, or\n2. a normally trusted OpenAPI description has been **compromised/tampered with**.\n\nIf you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.\n\n## Affected Versions\n\n- **Affected:** all versions **< 1.29.1** and **>= 1.30.0, < 1.31.1**\n- **Fixed:** **1.29.1, 1.31.1,** and later\n\n## Illustrative Exploit Example\n\n### Example OpenAPI fragment (malicious default value)\n\n```yaml\nopenapi: 3.0.1\ninfo:\n  title: Exploit Demo\n  version: 1.0.0\ncomponents:\n  schemas:\n    User:\n      type: object\n      properties:\n        displayName:\n          type: string\n          default: \"\\\"; throw new System.Exception(\\\"injected\\\"); //\"\n```\n\n### Example generated C# snippet before fix (illustrative)\n\n```csharp\npublic User() {\n    DisplayName = \"\"; throw new System.Exception(\"injected\"); //\";\n}\n```\n\nThe injected payload escapes the intended string context and introduces attacker-controlled statements in generated code.\n\n> Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations.\n\n## Remediation\n\n1. Upgrade Kiota to **1.31.1 or later**.\n2. Regenerate/refresh existing generated clients as a precaution:\n\n```bash\nkiota update\n```\n\nRefreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.\n\n## Acknowledgement\n\nWe would like to thank the researcher Thanatos Tian（Polyu) for finding this issue and for his contribution to this open source project.","published":"2026-04-22T20:20:57.541Z","modified":"2026-08-19T03:31:20.622681784Z","cvss":null,"epss":{"score":0.00421,"percentile":0.34733,"asOf":"2026-08-08"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.31.1"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.31.1"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.29.1"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.29.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41134.json"},{"type":"ADVISORY","url":"https://github.com/microsoft/kiota/security/advisories/GHSA-2hx3-vp6r-mg3f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41134"},{"type":"PACKAGE","url":"https://github.com/microsoft/kiota"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T03:31:20.622681784Z"}}