Code Injection Vulnerability in Kiota Ruby Generator by Microsoft

CVE-2026-59861

What is CVE-2026-59861?

Kiota, an OpenAPI based HTTP Client code generator, had a significant vulnerability prior to version 1.32.0 in its Ruby generator. The issue stemmed from the improper handling of embedded OpenAPI default fields and other schema-derived strings. Specifically, interpolation markers like #{expr}, #$var, and #@var were incorporated into Ruby double-quoted literals without adequate escaping. This flaw permitted attackers to inject arbitrary Ruby code into the generated model classes, potentially leading to severe security risks. The vulnerability was addressed and patched in version 1.32.0.

References