CVE-2026-59860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59860", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T15:41:53.606Z", "datePublished": "2026-07-16T14:34:24.549Z", "dateUpdated": "2026-08-17T15:01:37.307Z"}, "containers": {"cna": {"title": "Kiota: XML Doc-Comment Newline Breakout Code Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"}, {"name": "https://github.com/microsoft/kiota/pull/7831", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/pull/7831"}, {"name": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44"}, {"name": "https://github.com/microsoft/kiota/releases/tag/v1.32.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.3"}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"version": ">= 1.30.0, < 1.31.1", "status": "affected"}, {"version": "< 1.29.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:01:37.307Z"}, "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// \u2026 comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3."}], "source": {"advisory": "GHSA-3hrf-2gc2-mx32", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:34.813340Z"}}}], "references": [{"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32", "tags": ["exploit"]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:26:44.335Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T03:56:34.813340Z"}}}], "references": [{"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T14:52:37.729Z"}}], "cna": {"title": "Kiota: XML Doc-Comment Newline Breakout Code Injection", "source": {"advisory": "GHSA-3hrf-2gc2-mx32", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "microsoft", "product": "kiota", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}], "references": [{"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32", "name": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/microsoft/kiota/pull/7831", "name": "https://github.com/microsoft/kiota/pull/7831", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44", "name": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.3", "name": "https://github.com/microsoft/kiota/releases/tag/v1.32.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// \u2026 comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-17T15:01:37.307Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59860", "state": "PUBLISHED", "dateUpdated": "2026-08-17T15:01:37.307Z", "dateReserved": "2026-07-07T15:41:53.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T14:34:24.549Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kiota", "vendor": "microsoft", "versions": [{"status": "affected", "version": ">= 1.30.0, < 1.31.1"}, {"status": "affected", "version": "< 1.29.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// \u2026 comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3."}, {"lang": "es", "value": "Kiota es un generador de c\u00f3digo de cliente HTTP basado en OpenAPI. Antes de la versi\u00f3n 1.32.3, Kiota est\u00e1 afectado por una vulnerabilidad de inyecci\u00f3n en la generaci\u00f3n de c\u00f3digo en el sink de comentarios de documentaci\u00f3n XML de C# (los campos de descripci\u00f3n, etiqueta externalDocs y enlace externalDocs emitidos como comentarios /// ...). Cuando el texto de una descripci\u00f3n de OpenAPI se escribe en comentarios de documentaci\u00f3n XML de una sola l\u00ednea sin eliminar los caracteres de nueva l\u00ednea y los caracteres terminadores de l\u00ednea Unicode, un atacante puede salir de la l\u00ednea de comentario /// e inyectar c\u00f3digo adicional en los clientes C# generados. Este problema est\u00e1 solucionado en la versi\u00f3n 1.32.3."}], "id": "CVE-2026-59860", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59860", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T03:56:34.813340Z", "version": "2.0.3"}}]}, "published": "2026-07-16T15:16:35.310", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/pull/7831"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/releases/tag/v1.32.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.32.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kiota", "source": "cna", "vendor": "microsoft"}, "product": "kiota", "vendor": "microsoft"}], "created": "2026-07-16T15:30:05.646013+00:00", "updated": "2026-08-17T20:30:17.394963+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$kiota"]}