Documentation-Comment Sanitization Vulnerability in Kiota by Microsoft
CVE-2026-105796
Key Information:
- Vendor
Microsoft
- Vendor
- CVE Published:
- 6 October 2026
What is CVE-2026-105796?
Kiota, a powerful OpenAPI-based HTTP Client code generator, has a vulnerability affecting its Java and PHP documentation-comment sanitizers from versions 0.5.0 to 1.35.0. The issue arises when block-comment terminators are improperly handled, allowing attackers to craft malicious OpenAPI documentation that can execute arbitrary code. This happens when a developer generates source code from compromised documentation and incorporates it into their Java or PHP applications. The risk is heightened as the sanitizer may also delete critical non-ASCII characters, leading to further code execution vulnerabilities. This vulnerability has been addressed in version 1.35.0, emphasizing the need for users to update their installations to avoid potential exploitation.
Affected Version(s)
kiota >= 0.5.0, < 1.35.0
Microsoft.OpenApi.Kiota >= 0.5.0, < 1.35.0
Microsoft.OpenApi.Kiota.Builder >= 0.5.0, < 1.35.0