CVE-2026-105796: 
C# vulnerability analysis and mitigation

CVE-2026-105796 is a code injection vulnerability in Microsoft Kiota, an OpenAPI-based HTTP client code generator, affecting the Java and PHP documentation-comment sanitizers. The flaw exists in versions 0.5.0 through 1.34.x of the kiota, Microsoft.OpenApi.Kiota, and Microsoft.OpenApi.Kiota.Builder packages. It was published to the GitHub Advisory Database on October 6, 2026, with the fix released in version 1.35.0. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory).

The root cause (CWE-94: Improper Control of Generation of Code) lies in how Kiota's Java and PHP sanitizers handle block-comment terminators (*/) in OpenAPI description fields — they delete the two-character sequence rather than neutralizing it. Deleting */ allows surrounding characters to rejoin and re-form the terminator (e.g., **/ + / collapses to */), enabling attacker-controlled text from an OpenAPI description to escape the generated documentation comment and be placed as executable source code. The Java sanitizer compounds this by running the non-ASCII character strip before the terminator removal, meaning a sequence like *é/ (with a non-ASCII character between) re-forms */ after normalization. The fix, implemented in PR #8017, introduces a shared NeutralizeBlockCommentDelimiters() helper that replaces /* with //* and */ with * / (never deletes), and reorders Java's sanitization passes so neutralization runs after non-ASCII stripping (Github Advisory, Fix PR).

Successful exploitation allows an attacker who controls or tampers with an OpenAPI specification to inject arbitrary Java or PHP source code into Kiota-generated client files. When a developer or CI/CD pipeline generates a client from the malicious description and subsequently compiles the Java output or loads the PHP output, the injected code executes in the security context of the consuming application or build environment — potentially granting full confidentiality, integrity, and availability impact. This supply-chain attack vector means the injected code could exfiltrate secrets, modify application behavior, or compromise the build infrastructure itself (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a developer or automated pipeline must generate source code from a malicious OpenAPI description and then compile or load the output, limiting opportunistic exploitation but making targeted supply-chain attacks feasible.

1. Craft a malicious OpenAPI description: Create or tamper with an OpenAPI specification (YAML/JSON) by embedding a crafted payload in a description, summary, or externalDocs field. The payload uses character sequences that exploit the sanitizer's deletion behavior — for example, **/ or *é/ — to re-form a */ block-comment terminator after sanitization.
2. Deliver the malicious specification: Host the malicious OpenAPI file at a reachable URL, inject it into a supply-chain dependency, or perform a man-in-the-middle attack on an unprotected specification fetch to deliver it to a target developer or CI/CD pipeline.
3. Trigger client generation: The victim developer or automated build pipeline runs Kiota against the malicious OpenAPI description (e.g., kiota generate -d malicious-api.yaml -l java -o ./generated), causing Kiota to emit Java or PHP source files containing the attacker-controlled code outside a documentation comment.
4. Achieve code execution: The victim compiles the generated Java source or loads the generated PHP source as part of their normal build/deployment process. The injected code executes in the application's or build environment's security context, enabling actions such as credential theft, reverse shell establishment, or further lateral movement (Github Advisory, Fix PR).

• File System: Generated Java (.java) or PHP (.php) source files containing executable code outside of /** ... */ documentation comment blocks; presence of */ sequences in generated doc-comment fields that are not followed by expected comment structure.
• File System: Unexpected or anomalous content in Kiota-generated client directories, such as import statements, method calls, or shell commands embedded in what should be documentation strings.
• Logs: Build pipeline logs showing Kiota generation from external or unverified OpenAPI specification URLs; compilation errors or warnings in generated Java files referencing unexpected symbols.
• Process: Unusual processes spawned by the Java compiler (javac) or PHP interpreter during build steps, such as network connections, file writes outside expected directories, or execution of shell commands.

Upgrade Kiota (and the Microsoft.OpenApi.Kiota / Microsoft.OpenApi.Kiota.Builder NuGet packages) to version 1.35.0 or later, then regenerate all affected clients from trusted OpenAPI descriptions (Github Advisory, v1.35.0 Release). As an interim workaround prior to upgrading: generate clients only from trusted, integrity-verified OpenAPI specifications; manually review all generated Java and PHP source files before compiling or deploying them; and restrict the privileges, environment variables, and secrets available to code generation and build environments. Additionally, consider restricting the sources from which OpenAPI specifications are ingested in automated pipelines.