Repository navigation
[GHSA-rm89-rhwj-9j92] Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators - #10705
Open
neotrow wants to merge 1 commit into
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions
Bot
changed the base branch from
main
to
neotrow/advisory-improvement-10705
October 27, 2026 19:33
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Human confirmation is warranted before narrowing this high-severity advisory while the upstream advisory still lists the original affected range.
1 open issue
What changed in this PR
Updates Kiota’s security advisory to recognize the 1.29.2 backport for Java/PHP doc-comment code injection, improving vulnerability alerts for consumers on the 1.29.x security line.
Changes:
- Splits affected ranges for both NuGet packages, recognizing 1.29.2 as patched while retaining 1.30.0–1.34.1 as affected.
- Adds backport and release references and refreshes the advisory timestamp.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/10/GHSA-rm89-rhwj-9j92/GHSA-rm89-rhwj-9j92.json | Revises affected ranges and adds evidence for the 1.29.2 security backport. |
Review effort: Max
| "events": [ | ||
| { | ||
| "introduced": "0.5.0" | ||
| "introduced": "1.30.0" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
Kiota 1.29.2 (released 2026-10-09) backports the fix for this advisory to the 1.29.x security line, so it should be listed as patched. This is the same situation as GHSA-2hx3-vp6r-mg3f, where the 1.29.1 backport was carved out of the affected range.
Evidence:
security/1.29.Xon 2026-10-08 as b6a77ea774330d33da3cc03445ced7027e95218d.StringExtensions.NeutralizeBlockCommentDelimiters,JavaConventionService.RemoveInvalidDescriptionCharactersandPhpConventionService.RemoveInvalidDescriptionCharactersare identical to the original fix in 68f33b865be9273464a6efbbe17379760e51f1a4 (fix(java,php): neutralize doc-comment delimiters instead of deleting them microsoft/kiota#8017). That covers both variants the advisory describes: delimiters are neutralized instead of deleted, and the Java sanitizer neutralizes after the non-ASCII strip. The backport also carries the same regression tests, including the*é/normalization-order case.Microsoft.OpenApi.Kiota1.29.2 andMicrosoft.OpenApi.Kiota.Builder1.29.2 are both published on nuget.org.Proposed ranges, for both packages:
>= 0.5.0, < 1.29.2>= 1.30.0, < 1.35.0No release between 1.30.0 and 1.34.1 received the backport, so that part of the range is unchanged.
Why it matters: the 1.29.x line exists for consumers that are tied to
Microsoft.OpenApi2.x throughMicrosoft.AspNetCore.OpenApi10 and cannot move to Kiota 1.30+ (microsoft/kiota#8352).FastEndpoints.ClientGen.Kiotapins[1.29.2]for that reason. Those consumers currently get a high-severity alert with no reachable fix.The repository advisory at microsoft/kiota still shows the original range, so the maintainers may want to update it too.
🤖 Generated with Claude Code