OpenAPI Code Generator Vulnerability in Microsoft Kiota

CVE-2026-59866

What is CVE-2026-59866?

The vulnerability in Microsoft Kiota arises from improper sanitization of identifiers in generated client class and namespace names. Prior to version 1.32.5, an attacker could exploit this flaw by providing a compromised OpenAPI description, enabling the generation of source code components outside the specified output directory. This could lead to arbitrary text being injected into client class or namespace declarations, posing significant risks to application integrity. The flaw has been addressed with the introduction of GenerationConfiguration methods that ensure proper sanitization of client identifiers.

References