The vulnerability is a code generation literal injection identified as CWE‑94 in Kiota's PHP generator. Prior to 1.32.4, the generator inserted OpenAPI schema strings directly into double‑quoted PHP literals without escaping dollar signs. Based on the description, it is inferred that an attacker supplies a crafted OpenAPI specification that the generator processes, allowing PHP interpolation constructs such as ${…}, $var, or {$obj->prop} to be injected into the generated code and executed. Consequently, the injected PHP code runs within the environment that loads or executes the generated classes, leading to remote code execution.

Affected vendors and products: Microsoft Kiota, the OpenAPI‑based HTTP client code generator. Versions older than 1.32.4 are vulnerable. The fix is included in Kiota release 1.32.4 and subsequent versions; therefore, any installation of Kiota < 1.32.4 that processes potentially untrusted OpenAPI definitions is impacted.

The likely attack vector is an attacker supplying a crafted OpenAPI specification to the PHP generator. Based on the description, it is inferred that this allows the injection of PHP interpolation constructs into double‑quoted literals, leading to arbitrary code execution. Risk assessment shows a CVSS score of 8.7, indicating high severity. The EPSS score is 1%, suggesting a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Attack requires the generator to process untrusted OpenAPI definitions, which is typically a developer‑level or local effect, but can also be leveraged in automated build pipelines that consume untrusted specs. If not mitigated, the impact would be code execution on the environment where the generated PHP code runs. Therefore, organizations should consider the risk high when the generator is used in production environments.