CVE-2026-59862 — Microsoft.OpenAPI.Kiota
HIGHCVE-2026-59862 is a high-severity (CVSS 7.5) Code Injection vulnerability in Microsoft.OpenAPI.Kiota. A fix is available for Microsoft.OpenAPI.Kiota — see the affected versions and patch details below.
Kiota: Code Generation Literal Injection in the Python Generator
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-59862.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-59862 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 390,400 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
Microsoft.OpenAPI.Kiota.NETMicrosoft.OpenAPI.Kiota.Builder.NETMicrosoft.OpenApi.Kiota.NETMicrosoft.OpenApi.Kiota.BuilderReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.
The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.
This issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.
Impact
A malicious OpenAPI specification can cause arbitrary Python code to be emitted into generated model files. The payload executes when the affected module is imported.
Potential impact includes
Credential theft from developer or CI environments Exfiltration of environment variables and secrets Source code disclosure Persistence via regenerated backdoored client output Who is impacted Developers generating Python SDKs from external or untrusted OpenAPI specs Teams with CI/CD automation that regenerates clients from remote specification URLs Any environment importing generated Python modules before manual review Vulnerability details Two gaps combine to enable exploitation:
Enum description cleanup gap
In KiotaBuilder.SetEnumOptions, enum option descriptions are assigned to Documentation.DescriptionTemplate without CleanupDescription on this path, allowing control characters such as newlines to propagate.
Python description sanitization gap
PythonConventionService.RemoveInvalidDescriptionCharacters escapes backslashes and triple quotes but did not remove carriage return/newline characters, unlike some other language convention services.
Exploit path
Malicious newline in x-ms-enum description is emitted through enum writing path. Generated inline comment output is split by newline. Subsequent attacker-controlled line lands at module scope in generated .py file. Importing the module executes the injected code.
Attack vectors
OpenAPI specifications hosted at attacker-controlled URLs Supply-chain scenarios where third-party specs are consumed automatically CI pipelines that generate and then import or test generated Python clients
Patches
https://github.com/microsoft/kiota/pull/7735
Workarounds
If you cannot upgrade immediately:
Only generate from trusted, internally controlled OpenAPI specification sources. Disable or gate automatic generation from remote specs in CI/CD. Add validation/sanitization for x-ms-enum descriptions before generation. Review generated Python files for suspicious top-level statements near enum/model declarations. Run generation and validation in isolated environments without access to production secrets.
Remediation
Upgrade to Kiota 1.29.1, 1.32.0, or later.
Regenerate existing Python clients to replace previously generated vulnerable output.
Recommended validation after upgrade
Regenerate from the same spec used in proof-of-concept testing Confirm malicious multi-line enum descriptions no longer produce executable top-level output
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Microsoft.OpenAPI.Kiota | ≥ 1.30.0&&< 1.32.0 | 1.32.0dotnet add package Microsoft.OpenAPI.Kiota --version 1.32.0 |
| .NETNuGet | Microsoft.OpenAPI.Kiota.Builder | ≥ 1.30.0&&< 1.32.0 | 1.32.0dotnet add package Microsoft.OpenAPI.Kiota.Builder --version 1.32.0 |
| .NETNuGet | Microsoft.OpenApi.Kiota | all versions | 1.29.1dotnet add package Microsoft.OpenApi.Kiota --version 1.29.1 |
| .NETNuGet | Microsoft.OpenApi.Kiota.Builder | all versions | 1.29.1dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.29.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.OpenAPI.Kiota, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.OpenAPI.Kiota to 1.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-59862 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2026-59862 in your dependencies?
Find it across NuGet, including transitive dependencies.