CVE-2026-59861 Details

A code generation literal injection vulnerability has been identified in the Microsoft Kiota Ruby HTTP client code generator, affecting versions prior to 1.32.0. The issue arises because the generator embeds string values from OpenAPI default fields and property names directly into Ruby double-quoted string literals without properly escaping the '#' character. This oversight allows an attacker to inject arbitrary Ruby code into generated model classes by exploiting the interpolation markers #{expr}, #$var, or #@var. The vulnerability is rooted in the 'SanitizeForQuotedLiteral' function, which fails to escape the '#' character, enabling the injection of malicious code that could be executed at runtime.

Users are advised to upgrade Kiota to version 1.32.0 or later. After upgrading, regenerate any previously generated Ruby clients to ensure that the injected code has been removed and replaced with the sanitized version.