{"id":"CVE-2026-59859","sourceIdentifier":"security-advisories@github.com","published":"2026-07-16T15:16:35.167","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4."},{"lang":"es","value":"Kiota es un generador de código de cliente HTTP basado en OpenAPI. Antes de la versión 1.32.4, el generador PHP de Kiota incrustaba la descripción de OpenAPI, campos predeterminados, nombres de propiedades y otras cadenas derivadas del esquema en literales PHP entre comillas dobles a través de SanitizeDoubleQuote() en Writers/StringExtensions.cs sin escapar $, permitiendo que construcciones de interpolación controladas por el atacante como ${...}, $var, o {$obj  ->  prop} inyectaran código PHP arbitrario en las clases de modelo y de constructor de solicitudes generadas. Este problema está solucionado en la versión 1.32.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"kiota","versions":[{"version":">= 1.30.0, < 1.31.1","status":"affected"},{"version":"< 1.29.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-17T03:56:37.664979Z","id":"CVE-2026-59859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/pull/7863","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/releases/tag/v1.32.4","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j","source":"security-advisories@github.com"}]}