{"items":[{"id":"NVI-00015328","kind":"vulnerability","title":"Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7f3j-j7jj-r3vr","CVE-2026-59862"],"plain_summary":"GitHub lists this reviewed advisory for Microsoft.OpenAPI.Kiota, Microsoft.OpenAPI.Kiota.Builder, Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5b7b3743ddfebfa14e15f5c94ea45475"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-17T14:53:11.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5b7b3743ddfebfa14e15f5c94ea45475"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5b7b3743ddfebfa14e15f5c94ea45475","url":"https://github.com/advisories/GHSA-7f3j-j7jj-r3vr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7f3j-j7jj-r3vr","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:15:44.568Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5b7b3743ddfebfa14e15f5c94ea45475"],"technology":"Microsoft.OpenAPI.Kiota","known_exclusions":[],"conditions_summary":"Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.\n\nThe Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.\n\nThis issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.\n\n# Impact\n\nA malicious OpenAPI specification can cause arbitrary Python code to be emitted into generated model files. The payload executes when the affected module is imported.\n\n## Potential impact includes\n\nCredential theft from developer or CI environments\nExfiltration of environment variables and secrets\nSource code disclosure\nPersistence via regenerated backdoored client output\nWho is impacted\nDevelopers generating Python SDKs from external or untrusted OpenA","public_affected_ranges":[">= 1.30.0, < 1.32.0"]},{"certainty":"source_listed","source_ids":["sr-5b7b3743ddfebfa14e15f5c94ea45475"],"technology":"Microsoft.OpenAPI.Kiota.Builder","known_exclusions":[],"conditions_summary":"Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.\n\nThe Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.\n\nThis issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.\n\n# Impact\n\nA malicious OpenAPI specification can cause arbitrary Python code to be emitted into generated model files. The payload executes when the affected module is imported.\n\n## Potential impact includes\n\nCredential theft from developer or CI environments\nExfiltration of environment variables and secrets\nSource code disclosure\nPersistence via regenerated backdoored client output\nWho is impacted\nDevelopers generating Python SDKs from external or untrusted OpenA","public_affected_ranges":[">= 1.30.0, < 1.32.0"]},{"certainty":"source_listed","source_ids":["sr-5b7b3743ddfebfa14e15f5c94ea45475"],"technology":"Microsoft.OpenApi.Kiota","known_exclusions":[],"conditions_summary":"Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.\n\nThe Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.\n\nThis issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.\n\n# Impact\n\nA malicious OpenAPI specification can cause arbitrary Python code to be emitted into generated model files. The payload executes when the affected module is imported.\n\n## Potential impact includes\n\nCredential theft from developer or CI environments\nExfiltration of environment variables and secrets\nSource code disclosure\nPersistence via regenerated backdoored client output\nWho is impacted\nDevelopers generating Python SDKs from external or untrusted OpenA","public_affected_ranges":["< 1.29.1"]},{"certainty":"source_listed","source_ids":["sr-5b7b3743ddfebfa14e15f5c94ea45475"],"technology":"Microsoft.OpenApi.Kiota.Builder","known_exclusions":[],"conditions_summary":"Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.\n\nThe Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.\n\nThis issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.\n\n# Impact\n\nA malicious OpenAPI specification can cause arbitrary Python code to be emitted into generated model files. The payload executes when the affected module is imported.\n\n## Potential impact includes\n\nCredential theft from developer or CI environments\nExfiltration of environment variables and secrets\nSource code disclosure\nPersistence via regenerated backdoored client output\nWho is impacted\nDevelopers generating Python SDKs from external or untrusted OpenA","public_affected_ranges":["< 1.29.1"]}],"null_published_at":"2026-11-03T10:03:26.570Z","source_updated_at":"2026-08-17T14:53:11.000Z","source_disclosed_at":"2026-07-24T15:45:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:15:44.568Z"}],"next_cursor":null,"snapshot_revision":"42594"}