CVE-2026-41134: Microsoft Kiota code injection in generated clients

Executive brief

Microsoft Kiota is a tool used by developers to automatically generate software code (API clients) from technical descriptions of web services. A security flaw allows a malicious or compromised API description to inject hidden, unauthorized code into the generated software. If a developer uses an untrusted description, the resulting application could contain malicious logic that compromises data or system security.

Technical details

Kiota versions prior to 1.31.1 contain a code-generation literal injection vulnerability (CWE-94). The root cause is insufficient escaping of values from OpenAPI descriptions (such as default values, property names, or parameter mappings) when they are emitted into generated source code. An attacker who provides a malicious OpenAPI document can escape string literal contexts to inject arbitrary statements into the resulting client library. Exploitation requires a developer to run Kiota against a compromised or untrusted OpenAPI specification. The issue is fixed in version 1.31.1, and users are advised to regenerate existing clients after upgrading.

Affected products

• Microsoft Kiota < 1.31.1
• Microsoft Microsoft.OpenApi.Kiota < 1.31.1
• Microsoft Microsoft.OpenApi.Kiota.Builder < 1.31.1

Timeline

• 2026-04-13: disclosed: Initial disclosure in microsoft/kiota repository
• 2026-04-14: advisory: GitHub Advisory published
• 2026-04-22: other: Published to NVD

References

• https://api.github.com/users/baywet
• https://github.com/baywet
• https://api.github.com/users/baywet/gists%7B/gist_id%7D
• https://api.github.com/users/baywet/repos
• https://avatars.githubusercontent.com/u/7905502?v=4
• https://api.github.com/users/baywet/events%7B/privacy%7D