VYPR
High severityNVD Advisory· Published Jul 16, 2026· Updated Jul 29, 2026

Kiota: Code Generation Literal Injection in the Python Generator

CVE-2026-59862

Description

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.32.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.OpenAPI.KiotaNuGet
< 1.32.01.32.0
Microsoft.OpenAPI.Kiota.BuilderNuGet
< 1.32.01.32.0
Microsoft.OpenApi.KiotaNuGet
< 1.32.01.32.0
Microsoft.OpenApi.Kiota.BuilderNuGet
< 1.32.01.32.0

Affected products

1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.