CVE-2026-105796 in Kiota
Summary
by MITRE • 10/06/2026
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java sanitizer also removes non-ASCII characters after deleting terminators, which can create a new terminator during normalization. Exploitation requires a developer or build pipeline to generate source from the malicious description and then compile and load the Java output or load the PHP output, after which injected code executes in the consuming application or build environment context. The version range is based on the Java defect and does not assert that PHP generation existed in every affected release. This issue is fixed in version 1.35.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
Kiota serves as an OpenAPI-based HTTP client code generator, a tool widely used by developers to automate the creation of API clients from specification files. A critical security vulnerability was identified within versions ranging from 0.5.0 up to and including 1.35.0 affecting both Java and PHP generation modules. The core flaw resides in how these generators handle documentation comment sanitization when processing OpenAPI descriptions that contain potentially malicious content. Specifically, the sanitizers responsible for cleaning block comments were designed to remove dangerous terminators but failed to neutralize them properly. Instead of safely escaping or replacing the closing delimiter sequences, such as double slashes in Java or asterisks in PHP, the code simply deleted these characters from the input stream.
This deletion logic introduces a significant injection vulnerability due to how string concatenation and normalization occur during the generation process. When the terminator is removed rather than neutralized, it allows overlapping characters from adjacent text segments to merge. In many cases, this merging reconstructs a valid comment termination sequence that was not present in its original form within the raw input data. Consequently, attacker-controlled content embedded within the OpenAPI specification can effectively break out of the intended documentation context. For Java specifically, an additional layer of complexity exists where non-ASCII characters are stripped away after the initial deletion of terminators. This normalization step can inadvertently create new valid terminator sequences from previously safe character combinations, further expanding the attack surface for code injection attacks.
The operational impact of this vulnerability is severe because it leads to arbitrary code execution within the context of the consuming application or build environment. Exploitation does not occur at runtime through network traffic but rather during the development and compilation phases. An attacker who controls the OpenAPI specification file used by a developer or an automated CI/CD pipeline can inject malicious payloads. When Kiota generates source code from this compromised description, the resulting Java or PHP files will contain injected commands disguised as part of documentation comments. Once these generated sources are compiled and loaded into the application environment, the embedded code executes with the privileges of the build process or the running service. This effectively bypasses standard input validation mechanisms because the malicious content is introduced via a trusted tool that processes specification files rather than direct user input to an API endpoint.
From a classification perspective, this vulnerability aligns closely with CWE-79, which covers Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting, although in this context it manifests more broadly as Server-Side Code Injection due to the execution environment being the build pipeline or application runtime rather than just a browser. It also relates to CWE-20 where improper input validation allows for injection attacks. In terms of adversary tactics, this aligns with ATT&CK techniques involving Supply Chain Compromise and potentially Command and Scripting Interpreter abuse if the generated code is executed in an automated environment. The vulnerability highlights the risks associated with dynamic code generation tools that do not strictly enforce output encoding or sanitization boundaries when processing external specifications.
Mitigation for organizations using Kiota involves immediate upgrading to version 1.35.0 where this issue has been resolved. Developers should audit their build pipelines and CI/CD configurations to ensure they are pinned to secure versions of code generation tools. Furthermore, it is advisable to implement strict validation on OpenAPI specification files before feeding them into any automated generation process. This includes scanning for suspicious patterns or unexpected character sequences that might indicate an attempt at injection. Security teams should also consider implementing static analysis checks on generated source code in CI pipelines to detect anomalies such as malformed comments or unauthorized method calls that may have slipped through the sanitization logic of older Kiota versions.