CVE-2026-41134

Vulnerability

Overview

CVE-2026-41134 is a code-generation literal injection vulnerability in Kiota, an OpenAPI-based HTTP client code generator. Versions prior to 1.31.1 fail to properly escape values from OpenAPI descriptions when emitting them into generated source code across multiple writer sinks, including serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission [1][3]. This allows an attacker to break out of string literals and inject arbitrary code into the generated client.

Exploitation

Exploitation requires the OpenAPI description used for generation to be from an untrusted source or a normally trusted description to have been compromised or tampered with [1][3]. An attacker can craft a malicious OpenAPI document containing payloads in fields such as default values, property names, or parameter definitions. When Kiota processes this document, the malicious value is emitted into the generated source code without context-appropriate escaping, enabling the attacker to inject additional statements [3]. For example, a default value containing \"; throw new System.Exception(\"injected\"); // would be emitted as executable code in the generated C# client [3].

Impact

Successful exploitation allows an attacker to inject arbitrary code into the generated client library. This could lead to arbitrary code execution in the context of the application that uses the generated client, potentially compromising the confidentiality, integrity, and availability of the application and its data [1][3]. The impact is limited to scenarios where the generated client is built from an untrusted or tampered OpenAPI description.

Mitigation

The vulnerability is fixed in Kiota version 1.31.1 and later [1][3]. Users should upgrade to the latest version and regenerate any existing generated clients to replace potentially vulnerable code with hardened output. As a general best practice, only generate clients from trusted, integrity-protected OpenAPI descriptions to significantly reduce the risk of exploitation [1][3].