CVE-2026-59859: Microsoft Kiota PHP code injection in generated string literals

CVE-2026-59859 · Severity: high · CVSS 4 · Published 2026-07-16

Microsoft Kiota is a tool used by developers to automatically generate API client code. A vulnerability in its PHP code generator allows an attacker to inject malicious code into the generated files by providing a specially crafted API specification. If a developer uses an untrusted specification to generate their client, the resulting code could allow an attacker to execute arbitrary commands on the server where the application is deployed.

Technologies: Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota.Builder (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-59859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59859 being exploited in the wild.
How severe is CVE-2026-59859?
High severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Microsoft Kiota < 1.32.4; Microsoft.OpenApi.Kiota < 1.32.4; Microsoft.OpenApi.Kiota.Builder < 1.32.4; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.32.4; and 1 more.
Is there a fix for CVE-2026-59859?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.4 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59859 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59859?
Check whether you run Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.4 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.32.4
  • Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.4 or later
    dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.4

Technical details

The vulnerability exists in the Kiota PHP generator's 'StringExtensions.cs' component, specifically within the 'SanitizeDoubleQuote()' function. The generator fails to escape the '$' character when embedding OpenAPI fields (such as descriptions or default values) into PHP double-quoted string literals. Because PHP evaluates variables and expressions within double-quoted strings at runtime (interpolation), an attacker-controlled OpenAPI specification can include constructs like '{$eval(...)}' that will be executed when the generated PHP code is run. This is a remote attack vector requiring the victim to generate code from a malicious or compromised OpenAPI spec. A fix is available in version 1.32.4.

Affected products

  • Microsoft Microsoft.OpenApi.Kiota < 1.32.4
  • Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.4

Identifiers

  • CVE-2026-59859
  • GHSA-jqwh-526h-c92j

Timeline

  • 2026-06-30: disclosed
  • 2026-07-16: advisory: NVD publication
  • 2026-07-24: patched: GitHub Advisory published/reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.