Kiota’s Ruby code generator embeds OpenAPI default fields, property names, and other schema‑derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() into Ruby double‑quoted literals without escaping the # character. This allows attacker‑controlled interpolation markers such as #{…}, #$var, or #@var to be inserted by a malicious OpenAPI document. When the generated Ruby source file is loaded, the Ruby interpreter evaluates these markers, leading to arbitrary Ruby code execution under the privileges of the consuming application. This constitutes a code‑injection vulnerability (CWE‑94).

Microsoft Kiota, the open‑source OpenAPI‑based HTTP client generator, is affected for all versions prior to 1.32.0. The flaw exists in the Ruby code generator; other language generators are not implicated in the CVE. Any installation that has produced Ruby client classes from an untrusted OpenAPI document before the 1.32.0 release is vulnerable.

The CVSS score of 7.5 indicates a high‑severity vulnerability. The EPSS score of 1 % implies that, at present, the likelihood of the vulnerability being actively exploited is low, and it is not listed in the CISA KEV catalogue. The attack requires the ability to influence or supply the OpenAPI specification that Kiota uses during generation. Once a malicious document is processed, the resulting Ruby source file contains interpolated expressions that will run when the file is loaded or required by a Ruby application. Therefore, an attacker who can get the generated code to execute in a target environment can achieve arbitrary code execution in that environment.