Kiota is a code generator that turns OpenAPI clients. In versions prior to 1.32.3, the generator writes OpenAPI description fields directly into single‑line XML documentation comments (/// …). Because newline and Unicode line‑terminator characters are not stripped, an attacker can craft a description that breaks out of the comment and injects arbitrary code into the generated client. The injected code becomes part of the client source and will execute when the client is compiled and run, effectively enabling remote code execution on systems that use the generated code.

Microsoft Kiota, any version earlier than 1.32.3. The vulnerability exists in the code‑generation component of the product and affects all consumers who compile the generated C# clients from untrusted OpenAPI descriptors.

The CVSS score of 8.7 indicates high severity, while the EPSS score of 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious OpenAPI spec to the Kiota generator, a scenario that is plausible in environments with dynamic or user‑provided specifications. Once the spec is processed, the resulting code can be compiled, allowing the injected code to execute in the client’s runtime environment.