CVE-2026-59862 Details

A code generation literal injection vulnerability has been identified in the Microsoft Kiota Python HTTP client code generator, prior to version 1.32.0. This vulnerability allows attacker-controlled enum value descriptions from OpenAPI specifications to be injected into generated Python code without proper newline sanitization. As a result, when the generated modules are imported, the injected content can escape comment contexts and execute arbitrary Python code at the module scope. This issue arises from two main gaps: the first allows malicious descriptions to propagate without cleanup, and the second fails to sanitize newline characters in Python-specific description handling. The vulnerability is exploited by generating a client from a malicious OpenAPI specification and importing the resulting code, a common practice in development and continuous integration workflows.

Users are advised to upgrade to Kiota version 1.32.0 or later and regenerate any existing Python clients to replace the vulnerable output. After upgrading, clients should be regenerated from the same OpenAPI specification used during proof-of-concept testing to ensure that the vulnerability has been addressed.