CVE-2026-59859

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59859", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T15:41:53.606Z", "datePublished": "2026-07-16T14:40:27.319Z", "dateUpdated": "2026-08-17T15:02:29.204Z"}, "containers": {"cna": {"title": "Kiota: Code Generation Literal Injection in the PHP Generator", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j"}, {"name": "https://github.com/microsoft/kiota/pull/7863", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/pull/7863"}, {"name": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87"}, {"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4"}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"version": ">= 1.30.0, < 1.31.1", "status": "affected"}, {"version": "< 1.29.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:02:29.204Z"}, "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."}], "source": {"advisory": "GHSA-jqwh-526h-c92j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T03:56:37.664979Z", "id": "CVE-2026-59859", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:29:05.321Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59859", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:37.664979Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:29:01.194Z"}}], "cna": {"title": "Kiota: Code Generation Literal Injection in the PHP Generator", "source": {"advisory": "GHSA-jqwh-526h-c92j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}], "references": [{"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j", "name": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/microsoft/kiota/pull/7863", "name": "https://github.com/microsoft/kiota/pull/7863", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87", "name": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4", "name": "https://github.com/microsoft/kiota/releases/tag/v1.32.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:02:29.204Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59859", "state": "PUBLISHED", "dateUpdated": "2026-08-17T15:02:29.204Z", "dateReserved": "2026-07-07T15:41:53.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T14:40:27.319Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kiota", "vendor": "microsoft", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.4, el generador PHP de Kiota incrustaba la descripci\u00f3n de OpenAPI, campos predeterminados, nombres de propiedades y otras cadenas derivadas del esquema en literales PHP entre comillas dobles a trav\u00e9s de SanitizeDoubleQuote() en Writers/StringExtensions.cs sin escapar $, permitiendo que construcciones de interpolaci\u00f3n controladas por el atacante como ${...}, $var, o {$obj -> prop} inyectaran c\u00f3digo PHP arbitrario en las clases de modelo y de constructor de solicitudes generadas. Este problema est\u00e1 solucionado en la versi\u00f3n 1.32.4."}], "id": "CVE-2026-59859", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59859", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T03:56:37.664979Z", "version": "2.0.3"}}]}, "published": "2026-07-16T15:16:35.167", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/pull/7863"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.32.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kiota", "source": "cna", "vendor": "microsoft"}, "product": "kiota", "vendor": "microsoft"}], "created": "2026-07-16T15:30:05.645479+00:00", "updated": "2026-08-17T20:30:17.393173+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$kiota"]}