{"id":"CVE-2026-59860","aliases":["GHSA-3hrf-2gc2-mx32"],"url":"https://o3.security/vulnerability/CVE-2026-59860","summary":"Kiota: XML Doc-Comment Newline Breakout Code Injection","details":"Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.","published":"2026-07-16T14:34:24.549Z","modified":"2026-08-19T12:09:54.607697Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.32.3"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.32.3"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota","fixedVersion":"1.29.1"},{"ecosystem":"NuGet","name":"Microsoft.OpenApi.Kiota.Builder","fixedVersion":"1.29.1"}],"fix":{"url":"https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44","label":"microsoft/kiota@ebb632d"},"references":[{"type":"WEB","url":"https://github.com/microsoft/kiota/releases/tag/v1.32.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59860.json"},{"type":"ADVISORY","url":"https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59860"},{"type":"FIX","url":"https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44"},{"type":"FIX","url":"https://github.com/microsoft/kiota/pull/7831"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T12:09:54.607697Z"}}