CVE-2026-59860: Microsoft Kiota code injection in C# XML documentation comments

CVE-2026-59860 · Severity: high · CVSS 4 · Published 2026-07-16

Microsoft Kiota, a tool used to generate API client code, contains a vulnerability that allows malicious code to be hidden within API descriptions. If a developer uses a compromised or untrusted API specification to generate their code, the tool may inadvertently include and execute harmful commands during the software build process. This could lead to a full system compromise of the developer's environment or the final application.

Technologies: Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, Microsoft.OpenApi.Kiota (NuGet), Microsoft.OpenApi.Kiota.Builder (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-59860 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59860 being exploited in the wild.
How severe is CVE-2026-59860?
High severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Microsoft Kiota < 1.32.3; Microsoft.OpenApi.Kiota < 1.32.3; Microsoft.OpenApi.Kiota.Builder < 1.32.3; Microsoft.OpenApi.Kiota (NuGet) ECOSYSTEM:introduced=1.30.0,fixed=1.32.3; and 1 more.
Is there a fix for CVE-2026-59860?
Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.3 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59860 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59860?
Check whether you run Microsoft Kiota, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.3 or later
    dotnet add package Microsoft.OpenApi.Kiota --version 1.32.3
  • Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.3 or later
    dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.3

Technical details

A code injection vulnerability exists in Microsoft Kiota's C# code generation engine due to improper sanitization of input from OpenAPI descriptions. Specifically, the 'description', 'externalDocs' label, and 'externalDocs' link fields are emitted into single-line XML documentation comments (///) without stripping newline (\r, \n) or Unicode line-terminator characters (U+0085, U+2028, U+2029). An attacker can provide a malicious OpenAPI document containing these characters to terminate the comment context and inject arbitrary C# code. This code is then executed when the generated client is compiled by a developer or within a CI/CD pipeline. The vulnerability is fixed in version 1.32.3 by stripping these characters and normalizing tabs.

Affected products

  • Microsoft Microsoft.OpenApi.Kiota < 1.32.3
  • Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.3

Identifiers

  • CVE-2026-59860
  • GHSA-3hrf-2gc2-mx32

Timeline

  • 2026-06-25: disclosed: Initial report to Microsoft Kiota repository
  • 2026-07-16: advisory: NVD publication date
  • 2026-07-24: patched: GitHub Advisory published and fix confirmed in 1.32.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.