CVE-2026-105796 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Attackers can inject malicious code into generated Java or PHP clients via crafted OpenAPI descriptions, leading to code execution in the consuming application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-105796?
CVE-2026-105796 is a high-severity code injection vulnerability in Microsoft.OpenApi.Kiota, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java sanitizer also removes non-ASCII characters after deleting terminators, which can create a new terminator during normalization. Exploitation requires a developer or build pipeline to generate source from the malicious description and then compile and load the Java output or load the PHP output, after which injected code executes in the consuming application or build environment context. The version range is based on the Java defect and does not assert that PHP generation existed in every affected release. This issue is fixed in version 1.35.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-105796?
4 open source packages ship an affected version, including Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.OpenApi.Kiota NuGet | From 0.5.0 | 1.35.0 |
Microsoft.OpenApi.Kiota NuGet | From 0.5.0 | 1.35.0 |
Microsoft.OpenApi.Kiota.Builder NuGet | From 0.5.0 | 1.35.0 |
Microsoft.OpenApi.Kiota.Builder NuGet | From 0.5.0 | 1.35.0 |
How do I fix CVE-2026-105796?
Upgrade Microsoft.OpenApi.Kiota to 1.35.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-105796 being exploited?
There is no known exploitation of CVE-2026-105796 in the wild and no public exploit code.
Sources
Also known as GHSA-rm89-rhwj-9j92.