GHSA-2hx3-vp6r-mg3f
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2hx3-vp6r-mg3f
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-2hx3-vp6r-mg3f/GHSA-2hx3-vp6r-mg3f.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2hx3-vp6r-mg3f
- Aliases
- Published
- 2026-04-14T23:39:41Z
- Modified
- 2026-08-17T15:15:07Z
- Severity
-
- 0.0 (None) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS Calculator
- 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Kiota: Code Generation Literal Injection
- Details
-
CVE Advisory (CVE-2026-41134): Code Generation Literal Injection in Kiota
Summary
Kiota versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission).
When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients.
Impact and Preconditions
This issue is only practically exploitable when:
- the OpenAPI description used for generation is from an untrusted source, or
- a normally trusted OpenAPI description has been compromised/tampered with.
If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.
Affected Versions
- Affected: all versions < 1.29.1 and >= 1.30.0, < 1.31.1
- Fixed: 1.29.1, 1.31.1, and later
Illustrative Exploit Example
Example OpenAPI fragment (malicious default value)
openapi: 3.0.1 info: title: Exploit Demo version: 1.0.0 components: schemas: User: type: object properties: displayName: type: string default: "\"; throw new System.Exception(\"injected\"); //"Example generated C# snippet before fix (illustrative)
public User() { DisplayName = ""; throw new System.Exception("injected"); //"; }The injected payload escapes the intended string context and introduces attacker-controlled statements in generated code.
Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations.
Remediation
- Upgrade Kiota to 1.31.1 or later.
- Regenerate/refresh existing generated clients as a precaution:
kiota updateRefreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
Acknowledgement
We would like to thank the researcher Thanatos Tian（Polyu) for finding this issue and for his contribution to this open source project.
- Database specific
{ "cwe_ids": [ "CWE-94" ], "github_reviewed": true, "github_reviewed_at": "2026-04-14T23:39:41Z", "nvd_published_at": "2026-04-22T21:17:09Z", "severity": "HIGH" }- References
Affected packages
NuGet
Microsoft.OpenApi.Kiota
Package
- Name
- Microsoft.OpenApi.Kiota
- View open source insights on deps.dev
- Purl
- pkg:nuget/Microsoft.OpenApi.Kiota
Microsoft.OpenApi.Kiota.Builder
Package
- Name
- Microsoft.OpenApi.Kiota.Builder
- View open source insights on deps.dev
- Purl
- pkg:nuget/Microsoft.OpenApi.Kiota.Builder
Microsoft.OpenApi.Kiota
Package
- Name
- Microsoft.OpenApi.Kiota
- View open source insights on deps.dev
- Purl
- pkg:nuget/Microsoft.OpenApi.Kiota
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.29.1
Affected versions
0.*
1.*
Microsoft.OpenApi.Kiota.Builder
Package
- Name
- Microsoft.OpenApi.Kiota.Builder
- View open source insights on deps.dev
- Purl
- pkg:nuget/Microsoft.OpenApi.Kiota.Builder
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.29.1