CVE-2026-59861 is a high-severity (CVSS 7.5) Code Injection vulnerability in Microsoft.OpenAPI.Kiota. A fix is available for Microsoft.OpenAPI.Kiota — see the affected versions and patch details below.
Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-59861.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-59861 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 390,400 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
Microsoft.OpenAPI.Kiota.NETMicrosoft.OpenAPI.Kiota.Builder.NETMicrosoft.OpenApi.Kiota.NETMicrosoft.OpenApi.Kiota.BuilderReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution
Impact
The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby double-quoted string literals without properly escaping the # character. Since Ruby evaluates string interpolation expressions like #{expr}, #$var, and #@var within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary Ruby code into generated model classes.
Who is impacted
Developers using Kiota to generate Ruby API clients from external or untrusted OpenAPI specifications Teams with CI/CD pipelines configured to automatically regenerate client code from remote specs Applications that deploy generated Ruby code to production servers
Vulnerability details
Affected component: CodeMethodWriter.cs Root cause: The shared SanitizeForQuotedLiteral() function in Writers/StringExtensions.cs does not escape the # character
Attack vectors
OpenAPI default fields in schema properties Property wire-name hash keys in deserializer/serializer methods Any schema-derived string embedded in Ruby double-quoted literals Severity: Critical when generated code reaches production; High for CI/CD environments with access to production secrets; Medium for public third-party specs; Low for developer-controlled specs.
Patches
https://github.com/microsoft/kiota/pull/7746
Workarounds
If you cannot upgrade immediately:
- Audit and sanitize OpenAPI specifications: Review all OpenAPI specification files for any default values or property names containing the # character. Remove or replace any suspicious strings before code generation.
- Code review of generated files: Implement mandatory code review of all generated Ruby files before merging into any branch. Look for double-quoted strings containing #{, #$, or #@ patterns.
- Restrict specification sources: Only consume OpenAPI specifications from trusted internal sources. Avoid automatic code generation from external or third-party APIs until this patch is applied.
- Isolate generated code from production: Do not deploy generated Ruby models to production environments unless the specification source has been verified and reviewed.
- Manual escaping (temporary): If regeneration is not possible, manually inspect and edit generated files to escape any # characters in string literals (replace # with # in double-quoted strings).
Remediation
Upgrade Kiota to 1.29.1, 1.32.0, or later. Regenerate/refresh existing generated clients as a precaution:
kiota update
Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Microsoft.OpenAPI.Kiota | ≥ 1.30.0&&< 1.32.0 | 1.32.0dotnet add package Microsoft.OpenAPI.Kiota --version 1.32.0 |
| .NETNuGet | Microsoft.OpenAPI.Kiota.Builder | ≥ 1.30.0&&< 1.32.0 | 1.32.0dotnet add package Microsoft.OpenAPI.Kiota.Builder --version 1.32.0 |
| .NETNuGet | Microsoft.OpenApi.Kiota | all versions | 1.29.1dotnet add package Microsoft.OpenApi.Kiota --version 1.29.1 |
| .NETNuGet | Microsoft.OpenApi.Kiota.Builder | all versions | 1.29.1dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.29.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.OpenAPI.Kiota, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.OpenAPI.Kiota to 1.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-59861 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2026-59861 in your dependencies?
Find it across NuGet, including transitive dependencies.