# CVE-2026-59861: Microsoft Kiota Ruby code injection in generated string literals

Source: https://junglewise.ai/threats/cve-2026-59861-microsoft-kiota-ruby-code-injection-in-generated-string-literals  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-59861 · Severity: high · CVSS 7.5 · Published 2026-07-16

Microsoft Kiota is a tool used by developers to automatically generate API client code. A vulnerability in the Ruby code generator allows an attacker to inject malicious code into the generated client by providing a specially crafted OpenAPI specification file. If this generated code is deployed, it could lead to unauthorized code execution on production servers or within development pipelines.

Technologies: [Microsoft Kiota](https://junglewise.ai/threats/technologies/kiota), [Microsoft Kiota.Builder](https://junglewise.ai/threats/technologies/kiota-builder), [Microsoft.OpenApi.Kiota](https://junglewise.ai/threats/technologies/microsoft-openapi-kiota), [Microsoft.OpenApi.Kiota.Builder](https://junglewise.ai/threats/technologies/microsoft-openapi-kiota-builder), [Microsoft.OpenApi.Kiota (NuGet)](https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota), [Microsoft.OpenApi.Kiota.Builder (NuGet)](https://junglewise.ai/threats/technologies/nuget-microsoft-openapi-kiota-builder). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-59861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59861 being exploited in the wild.

**How severe is CVE-2026-59861?** High severity, with a CVSS score of 7.5, published 16 July 2026.

**Which products and versions are affected?** Microsoft Kiota < 1.32.0; Microsoft Kiota.Builder < 1.32.0; Microsoft.OpenApi.Kiota < 1.32.0; Microsoft.OpenApi.Kiota.Builder < 1.32.0; and 2 more.

**Is there a fix for CVE-2026-59861?** Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.0 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59861 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59861?** Check whether you run Microsoft Kiota, Microsoft Kiota.Builder, Microsoft.OpenApi.Kiota or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.0 or later

  ```sh
  dotnet add package Microsoft.OpenApi.Kiota --version 1.32.0
  ```

- Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.0 or later

  ```sh
  dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.0
  ```


## Technical details

The Kiota Ruby code generator fails to properly escape the '#' character when embedding string values from OpenAPI default fields and property names into Ruby double-quoted string literals. Because Ruby evaluates string interpolation (e.g., #{expr}) within double-quoted strings at runtime, an attacker who controls an OpenAPI specification can inject arbitrary Ruby code into the generated model classes. The root cause is located in the SanitizeForQuotedLiteral() function within Writers/StringExtensions.cs. This vulnerability is particularly critical for CI/CD pipelines that automatically consume untrusted or remote OpenAPI specifications. Users should upgrade to version 1.32.0 or later and regenerate existing clients.

## Affected products

- Microsoft Microsoft.OpenAPI.Kiota < 1.32.0
- Microsoft Microsoft.OpenAPI.Kiota.Builder < 1.32.0

## Identifiers

- CVE-2026-59861
- GHSA-xg2h-5xr2-29jw

## Timeline

- 2026-06-30: disclosed: Initial disclosure by baywet
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/baywet](https://api.github.com/users/baywet)
- [https://github.com/baywet](https://github.com/baywet)
- [https://api.github.com/users/baywet/gists%7B/gist_id%7D](https://api.github.com/users/baywet/gists%7B/gist_id%7D)
- [https://api.github.com/users/baywet/repos](https://api.github.com/users/baywet/repos)
- [https://avatars.githubusercontent.com/u/7905502?v=4](https://avatars.githubusercontent.com/u/7905502?v=4)
- [https://api.github.com/users/baywet/events%7B/privacy%7D](https://api.github.com/users/baywet/events%7B/privacy%7D)

## Related threats

- [Microsoft Kiota documentation-comment injection in Java and PHP](https://junglewise.ai/threats/cve-2026-105796-kiota-is-an-openapi-based-http-client-code-generator-from-0-5-0)
- [Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests](https://junglewise.ai/threats/cve-2026-105795-kiota-is-an-openapi-based-http-client-code-generator-from-1-25-1)
- [Microsoft Kiota path traversal in plugin manifest via percent-encoding bypass](https://junglewise.ai/threats/cve-2026-73851-microsoft-kiota-path-traversal-in-plugin-manifest-via-percent)
- [Microsoft Kiota SSRF and File Inclusion via OpenAPI external references](https://junglewise.ai/threats/cve-2026-59867-microsoft-kiota-ssrf-and-file-inclusion-via-openapi-external)
- [Microsoft Kiota path traversal and code injection in OpenAPI generation](https://junglewise.ai/threats/cve-2026-59866-microsoft-kiota-path-traversal-and-code-injection-in-openapi)