Kiota is an OpenAPI‑based HTTP client code generator. In versions before 1.29.1 and 1.32.0 the Python generator allowed attacker‑controlled enum value descriptions (x‑ms‑enum.values[].description) to flow unchecked into the documentation template and comment rendering logic. Because newline characters were not sanitized, malicious input could break out of comments and be interpreted as executable Python code when the generated module was imported, giving the attacker the ability to run arbitrary code on the system that imports the generated client.

Microsoft Kiota Python generator versions earlier than 1.32.0 are impacted. The fix is included in releases 1.29.1 and 1.32.0 and later.

The CVSS score of 7.5 denotes high severity. The exploit requires control of the OpenAPI specification supplied to the generator, so the attack vector is limited to the environment where code generation occurs. Based on the description, it is inferred that the attack can only be carried out locally during the build or generation process. The EPSS score of 1 % indicates a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. Nevertheless, if an untrusted OpenAPI definition is processed, arbitrary code could be executed on the host running Kiota.