CVE-2026-41134
Kiota: Code Generation Literal Injection
Summary
# CVE Advisory (CVE-2026-41134): Code Generation Literal Injection in Kiota ## Summary Kiota versions **prior to 1.31.1** are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. ## Impact and Preconditions This issue is only practically exploitable when: 1. the OpenAPI description used for generation is from an **untrusted source**, or 2. a normally trusted OpenAPI description has been **compromised/tampered with**. If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced. ## Affected Versions - **Affected:** all versions ** Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations. ## Remediation 1. Upgrade Kiota to **1.31.1 or later**. 2. Regenerate/refresh existing generated clients as a precaution: ```bash kiota update ``` Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output. ## Acknowledgement We would like to thank the researcher Thanatos Tian（Polyu) for finding this issue and for his contribution to this open source project.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| NuGet | kiota | — | 1.31.1 |
| NuGet | Microsoft.OpenApi.Kiota | — | 1.31.1 |
| NuGet | Microsoft.OpenApi.Kiota.Builder | — | 1.31.1 |
Remediation: Upgrade to 1.31.1 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.