PHP Code Injection Vulnerability in Kiota HTTP Client Code Generator by Microsoft
CVE-2026-59859

8.7HIGH

Key Information:

Vendor: Microsoft
Status: Kiota
Vendor: CVE Published:; 16 July 2026

What is CVE-2026-59859?

The Kiota HTTP Client code generator, designed for OpenAPI, has a vulnerability that allows for PHP code injection. This arises from the improper handling of embedded OpenAPI descriptions and schema-derived strings in PHP double-quoted literals. The SanitizeDoubleQuote() function fails to adequately escape interpolation constructs, including ${...}, $var, and {$obj->prop}. This flaw could lead to arbitrary PHP code execution within the generated model and request-builder classes. Microsoft has addressed this issue in version 1.32.4.