Quick answers
- Is CVE-2026-59862 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59862 being exploited in the wild.
- How severe is CVE-2026-59862?
- High severity, with a CVSS score of 7.5, published 16 July 2026.
- Which products and versions are affected?
- Microsoft Kiota < 1.32.0; Microsoft Kiota.Builder < 1.32.0; Microsoft.OpenApi.Kiota < 1.32.0; Microsoft.OpenApi.Kiota.Builder < 1.32.0; and 2 more.
- Is there a fix for CVE-2026-59862?
- Yes. Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.0 or later; Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59862 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59862?
- Check whether you run Microsoft Kiota, Microsoft Kiota.Builder, Microsoft.OpenApi.Kiota or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Microsoft.OpenApi.Kiota (NuGet): upgrade to 1.32.0 or later
dotnet add package Microsoft.OpenApi.Kiota --version 1.32.0 - Microsoft.OpenApi.Kiota.Builder (NuGet): upgrade to 1.32.0 or later
dotnet add package Microsoft.OpenApi.Kiota.Builder --version 1.32.0
Technical details
A code generation literal injection vulnerability exists in the Kiota Python generator due to improper sanitization of enum value descriptions. Specifically, the 'x-ms-enum.values[].description' field in an OpenAPI specification can contain unsanitized newline characters that escape Python comment contexts. This occurs because 'KiotaBuilder.SetEnumOptions' fails to call 'CleanupDescription' and 'PythonConventionService.RemoveInvalidDescriptionCharacters' does not strip carriage return or newline characters. An attacker can provide a malicious specification that, when processed, generates Python files containing arbitrary code at the module scope. This code executes automatically when the generated module is imported in a developer's environment or CI/CD pipeline. The issue is fixed in version 1.32.0.
Affected products
- Microsoft Microsoft.OpenAPI.Kiota < 1.32.0
- Microsoft Microsoft.OpenAPI.Kiota.Builder < 1.32.0
Identifiers
- CVE-2026-59862
- GHSA-7f3j-j7jj-r3vr
Timeline
- 2026-06-30: disclosed
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory published