Kiota is a code generator that turns OpenAPI specifications into C# clients. In versions before 1.29.1 and 1.32.3, the generator writes OpenAPI description fields—including the description, externalDocs label, and externalDocs link—directly into single-line XML documentation comments (/// …). Because newline and Unicode line-terminator characters are not removed, an attacker can include a crafted OpenAPI description that breaks out of the comment and injects arbitrary C# code into the generated client source. The injected code becomes part of the compiled client and will execute when the client runs, giving the attacker remote code execution capabilities when the client is used.

Microsoft Kiota, any version earlier than 1.32.3. The vulnerability exists in the code‑generation component of the product and affects all consumers who compile the generated C# clients from untrusted OpenAPI descriptors.

The CVSS score of 8.7 indicates high severity, while the EPSS score of 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious OpenAPI spec to the Kiota generator, a scenario that is plausible in environments with dynamic or user-provided specifications. Once the spec is processed, the resulting code can be compiled, allowing the injected code to execute in the client’s runtime environment.