CVE-2026-59861
Last modified
CVE-2026-59861 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. EPSS estimates a 1.47% chance of exploitation in the next 30 days.
Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.32.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| microsoft | kiota | < 1.32.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-59861?
How severe is CVE-2026-59861?
How do I fix CVE-2026-59861?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-59856Vim is an open source, command line text editor. Prior to 9.…7.8
- CVE-2026-59857Vim is an open source, command line text editor. Prior to 9.…5.5
- CVE-2026-59858Vim is an open source, command line text editor. Prior to 9.…7.8
- CVE-2026-59859Kiota is an OpenAPI based HTTP Client code generator. Prior …8.7
- CVE-2026-5986A weakness has been identified in Zod jsVideoUrlParser up to…5.5
- CVE-2026-59860Kiota is an OpenAPI based HTTP Client code generator. Prior …8.7
- CVE-2026-59862Kiota is an OpenAPI based HTTP Client code generator. Prior …7.5
- CVE-2026-59863Kiota is an OpenAPI based HTTP Client code generator. Prior …7
- CVE-2026-59864Kiota is an OpenAPI based HTTP Client code generator. Prior …9.3
- CVE-2026-59865Kiota is an OpenAPI based HTTP Client code generator. Prior …9.3
- CVE-2026-59866Kiota is an OpenAPI based HTTP Client code generator. Prior …9.3
- CVE-2026-59867Kiota is an OpenAPI based HTTP Client code generator. Prior …7.1
Are you affected by CVE-2026-59861?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST