Summary
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments).
When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.
Impact and Preconditions
This issue is only practically exploitable when:
- the OpenAPI description used for generation is from an untrusted source, or
- a normally trusted OpenAPI description has been compromised/tampered with.
The injected code is compiled (and may execute) when the developer or CI builds the generated client. If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.
Affected Versions
- Affected: all versions < 1.32.3
- Fixed: 1.32.3 and later
Illustrative Exploit Example
Example OpenAPI fragment (malicious description)
openapi: 3.0.1
info:
title: Exploit Demo
version: 1.0.0
description: |-
Legitimate summary text
public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }
The newline inside description (also exploitable via \r, U+0085, U+2028, U+2029) terminates the doc-comment line.
Example generated C# snippet before fix (illustrative)
/// Legitimate summary text
public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }
The injected payload escapes the intended /// comment context and introduces attacker-controlled statements in generated code.
Note: this exploit is not limited to the description field, but may also impact the externalDocs label and link text and other doc-comment-derived locations.
Impact
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Upgrade Kiota to 1.32.3 or later.
- Regenerate/refresh existing generated clients as a precaution:
Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output. The fix (PR microsoft/kiota#7831) strips \r, \n, \u0085, \u2028, \u2029 (and normalizes tabs) from description, label, and link text before emitting doc comments.
Frequently Asked Questions
- What is CVE-2026-59860? CVE-2026-59860 is a high-severity code injection vulnerability in Microsoft.OpenApi.Kiota (nuget), affecting versions < 1.32.3. It is fixed in 1.32.3. Untrusted input is evaluated as executable code within the application's runtime environment.
- Which packages are affected by CVE-2026-59860?
Microsoft.OpenApi.Kiota(nuget) (versions < 1.32.3)Microsoft.OpenApi.Kiota.Builder(nuget) (versions < 1.32.3)
- Is there a fix for CVE-2026-59860? Yes. CVE-2026-59860 is fixed in 1.32.3. Upgrade to this version or later.
- Is CVE-2026-59860 exploitable, and should I be worried? Whether CVE-2026-59860 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-59860 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-59860?
- Upgrade
Microsoft.OpenApi.Kiotato 1.32.3 or later - Upgrade
Microsoft.OpenApi.Kiota.Builderto 1.32.3 or later
- Upgrade