CVE-2026-59859: Microsoft Kiota PHP code injection in generated string literals

Executive brief

Microsoft Kiota is a tool used by developers to automatically generate API client code. A vulnerability in its PHP code generator allows an attacker to inject malicious code into the generated files by providing a specially crafted API specification. If a developer uses an untrusted specification to generate their client, the resulting code could allow an attacker to execute arbitrary commands on the server where the application is deployed.

Technical details

The vulnerability exists in the Kiota PHP generator's 'StringExtensions.cs' component, specifically within the 'SanitizeDoubleQuote()' function. The generator fails to escape the ' character when embedding OpenAPI fields (such as descriptions or default values) into PHP double-quoted string literals. Because PHP evaluates variables and expressions within double-quoted strings at runtime (interpolation), an attacker-controlled OpenAPI specification can include constructs like '{$eval(...)}' that will be executed when the generated PHP code is run. This is a remote attack vector requiring the victim to generate code from a malicious or compromised OpenAPI spec. A fix is available in version 1.32.4.

Affected products

• Microsoft Microsoft.OpenApi.Kiota < 1.32.4
• Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.4

Timeline

• 2026-06-30: disclosed
• 2026-07-16: advisory: NVD publication
• 2026-07-24: patched: GitHub Advisory published/reviewed

References

• https://api.github.com/users/peombwa
• https://github.com/peombwa
• https://api.github.com/users/peombwa/gists%7B/gist_id%7D
• https://api.github.com/users/peombwa/repos
• https://avatars.githubusercontent.com/u/7061532?v=4
• https://api.github.com/users/peombwa/events%7B/privacy%7D