Kiota is an OpenAPI based HTTP client code generator. Versions prior to 1.31.1 are vulnerable to a code-generation literal injection flaw that allows malicious values from an OpenAPI description to be emitted into generated source without context-appropriate escaping. This flaw can break out of string literals and inject additional code, creating the possibility of arbitrary code execution in the generated clients. The weakness is identified by CWE-94.

The vulnerability affects Microsoft Kiota. Any Kiota installation using a version earlier than 1.31.1 is susceptible. Products relying on this generator for client code that accept OpenAPI definitions from untrusted or compromised sources are at risk.

The CVSS score of 7.3 indicates a medium to high severity risk. The EPSS score of 0.00051 reflects an extremely low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be an attacker who supplies a malicious OpenAPI description to a build environment that uses Kiota, allowing the generation of client code that contains injected malicious logic which can lead to arbitrary code execution in that environment. The risk is substantially mitigated when the generation process uses trusted, integrity-protected API descriptions.