CVE-2026-59860: Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments).
When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.
References
- github.com/advisories/GHSA-3hrf-2gc2-mx32
- github.com/microsoft/kiota/commit/ebb632db90aa8e3c20949337d9faa2720d64ca44
- github.com/microsoft/kiota/pull/7831
- github.com/microsoft/kiota/releases/tag/v1.32.3
- github.com/microsoft/kiota/security/advisories/GHSA-3hrf-2gc2-mx32
- nvd.nist.gov/vuln/detail/CVE-2026-59860
Code Behaviors & Features
Detect and mitigate CVE-2026-59860 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →