Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Made the MSRC 2026 Q2 Points Leaderboard 🎯 Landed two CVEs in Microsoft Kiota (CVE-2026-59860, CVE-2026-59859) this quarter, and this is the payoff. @msftsecresponse #hamzaharoon https://t.co/Tx4oLF10K8
Post summary
The user posts a brief acknowledgment of two new Microsoft Kiota CVEs discovered in Q2 2026, with no technical, exploit, or mitigation details provided.
@msftsecresponse CVE-2026-59860, C# generator. Kiota was writing OpenAPI description strings into XML doc comments without proper escaping. A crafted description breaks out of comment and drop attacker-controlled code into the generated client. https://nvd.nist.gov/vuln/detail/CVE-2026-59860
Post summary
The post discloses that CVE‑2026‑59860 in Kiota allows code injection via malicious OpenAPI descriptions, but it does not mention active exploitation, a PoC, or a patch.