Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Made the MSRC 2026 Q2 Points Leaderboard 🎯 Landed two CVEs in Microsoft Kiota (CVE-2026-59860, CVE-2026-59859) this quarter, and this is the payoff. @msftsecresponse #hamzaharoon https://t.co/Tx4oLF10K8
Post summary
The tweet announces that two CVEs (CVE-2026-59860, CVE-2026-59859) were landed in Microsoft Kiota for the MSRC 2026 Q2 Points Leaderboard, but offers no additional technical or exploit details.
@msftsecresponse CVE-2026-59859, PHP generator. OpenAPI-derived strings (defaults, property names, etc) were embedded into generated PHP without escaping, so a malicious spec could break out of the string literal and inject code. https://nvd.nist.gov/vuln/detail/CVE-2026-59859
Post summary
The tweet highlights the technical flaw in CVE‑2026‑59859 that permits code injection via unescaped OpenAPI strings in a PHP generator, but it does not provide a PoC, exploit, patch, or reports of active exploitation.