The vulnerability occurs in Kiota, an OpenAPI‑based HTTP client generator, where the Java and PHP documentation‑comment sanitizers remove block‑comment terminators instead of neutralizing them. This allows attacker‑controlled OpenAPI text to form a terminator that re‑opens a documentation comment, placing malicious code outside the comment during generated source compilation. The defect also deletes non‑ASCII characters after terminator removal, further enabling terminator regeneration. Exploitation requires the malicious OpenAPI description to be processed by Kiota in a build environment or by a developer, producing code that is subsequently compiled or evaluated. When the compiled Java class or the loaded PHP code is executed, the injected snippets run in the context of the consuming application or build pipeline, potentially compromising the entire environment.

Affected products include Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder, and kiota from Microsoft. The vulnerability spans Kiota versions 0.5.0 through 1.35.0, with the defect driven by the Java sanitizer; it is not certain that PHP generation was present in all affected releases of that range. The issue was addressed in release 1.35.0.

The CVSS score of 8.8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the attack can be carried out by any developer or CI/CD pipeline that feeds a malicious OpenAPI spec to Kiota. Once the generated code is compiled or loaded, the injected code executes with the privileges of the application or build process. Given the need to run Kiota to produce client code, the crash or exploitation path is realistic in environments where OpenAPI definitions are sourced from untrusted inputs.