Kiota’s Ruby generator embeds OpenAPI default fields, property names, and other schema‑derived strings directly into double‑quoted Ruby literals without escaping the characters that start string interpolation. An attacker who can supply a crafted OpenAPI definition can insert interpolation markers such as #{…}, #$var or #@var. When the generated Ruby client is loaded, the Ruby interpreter evaluates these markers, causing arbitrary Ruby code to execute with the same privileges as the consumer of the client. Because the generator writes these strings to a file, the flaw constitutes a code‑injection vulnerability (CWE‑94).

Microsoft Kiota, the open‑source OpenAPI‑based HTTP client generator, is affected for all versions prior to 1.32.0. The flaw exists in the Ruby code generator; other language generators are not implicated in the CVE. Any installation that has produced Ruby client classes from an untrusted OpenAPI document before the 1.32.0 release is vulnerable.

The CVSS score of 7.5 indicates a high‑severity vulnerability. The EPSS score of 1 % implies that, at present, the likelihood of the vulnerability being actively exploited is low, and it is not listed in the CISA KEV catalogue. The attack requires the ability to influence or supply the OpenAPI specification that Kiota uses during generation. Once a malicious document is processed, the resulting Ruby source file contains interpolated expressions that will run when the file is loaded or required by a Ruby application. Therefore, an attacker who can get the generated code to execute in a target environment can achieve arbitrary code execution in that environment.