Code Generation Injection Vulnerability in Kiota by Microsoft

CVE-2026-41134

What is CVE-2026-41134?

Kiota, an OpenAPI-based HTTP Client code generator, is susceptible to a code-generation literal injection vulnerability in various writer sinks, including serialization and deserialization keys, path/query parameter mappings, and URL template metadata. If malicious values from an untrusted or compromised OpenAPI description are incorporated into generated source code, it may allow attackers to escape string literals and introduce additional code. To mitigate this issue, users should only generate code from trusted, integrity-protected API descriptions, and upgrade to Kiota version 1.31.1 or later, followed by regenerating existing clients to fortify against potential exploits.

References