CVE-2026-59860 Kiota: XML Doc-Comment Newline Breakout Code Injection
Attackers can inject malicious code into generated C# clients via crafted OpenAPI descriptions, requiring developers to upgrade Kiota.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59860?
CVE-2026-59860 is a high-severity code injection vulnerability in microsoft kiota, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.
Weakness: CWE-94
Which versions are affected by CVE-2026-59860?
8 open source packages ship an affected version, including Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.OpenApi.Kiota NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota NuGet | From 1.30.0 | 1.32.3 |
Microsoft.OpenApi.Kiota NuGet | From 1.30.0 | 1.32.3 |
Microsoft.OpenApi.Kiota.Builder NuGet | All versions | 1.29.1 |
Microsoft.OpenApi.Kiota.Builder NuGet | All versions | 1.29.1 |
2 more packages
Microsoft.OpenApi.Kiota.Builder NuGet | From 1.30.0 | 1.32.3 |
Microsoft.OpenApi.Kiota.Builder NuGet | From 1.30.0 | 1.32.3 |
How do I fix CVE-2026-59860?
Upgrade Microsoft.OpenApi.Kiota to a fixed version for your release line: 1.29.1 or 1.32.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-59860 being exploited?
There is no known exploitation of CVE-2026-59860 in the wild and no public exploit code.
Sources
Also known as GHSA-3hrf-2gc2-mx32.