CVE-2026-59861 Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...

CVE-2026-59861 Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...

CVE-2026-59861 Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...

CVE-2026-59860 Kiota: XML Doc-Comment Newline Breakout Code Injection

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

CVE-2026-59860

Kiota is an OpenAPI-based HTTP client code generator. Prior to 1.32.3, it is affected by a code-generation injection in the C# XML documentation-comment sink when OpenAPI descriptions are written into single-line /// comments without stripping newline/Unicode terminators, allowing injection into ...

CVE-2026-59860

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

CVE-2026-59860 Kiota: XML Doc-Comment Newline Breakout Code Injection

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

CVE-2026-59860 Kiota: XML Doc-Comment Newline Breakout Code Injection

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

CVE-2026-59860

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an...

Splunk Authenticated RCE via SimpleXML Dashboard PDF (CVE-2022-43571)

Exploits CVE-2022-43571 in Splunk Enterprise: authenticated Python code injection via sparkline style parameters fillColor/lineColor in a SimpleXML dashboard. Payload executes when PDF export is triggered. Affected: versions prior to 8.1.12, 8.2.0 through 8.2.8, and 9.0.0 through 9.0.1. Requires...

PT-2026-60479

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions 1.30.0 through 1.32.2 Description Kiota, an OpenAPI based HTTP Client code generator, contains a code-generation injection flaw in the C XML documentation-comment sink. The issue occurs when text...

PT-2026-60480

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.0 Description The Ruby generator in Kiota fails to properly escape the character when embedding OpenAPI default fields, property names, and other schema-derived strings into Ruby double-quoted literals. This occurs...

CVE-2026-63397: Improper Encoding or Escaping of Output

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

CVE-2026-44632: Improper Control of Generation of Code

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino...

CVE-2026-59861: Improper Control of Generation of Code

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...

PT-2026-60684

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...

PT-2026-76007

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

PT-2026-60481

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.0 Description Kiota is an OpenAPI based HTTP Client code generator. The Python generator fails to sanitize newlines in enum value descriptions provided via x-ms-enum.values.description. This data flows through...

CVE-2026-59859: Improper Control of Generation of Code

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote in Writers/StringExtensions.cs without...

PT-2026-60478

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions prior to 1.32.4 Description The PHP generator in Kiota is subject to a code generation literal injection. The SanitizeDoubleQuote function in Writers/StringExtensions.cs fails to escape the $...