The vulnerability arises when a malicious enum description is injected into Kiota’s Python generator. The input flows directly into documentation templates without sanitizing newlines, enabling attacker-controlled code to appear in inline comments that are executed when the generated module is imported, effectively allowing arbitrary Python code execution.

The issue affects Microsoft Kiota versions earlier than 1.32.0. Users employing these earlier releases for OpenAPI code generation are susceptible; the fix is provided in Kiota v1.32.0 and later.

The CVSS score of 7.5 indicates high severity. Because the exploit requires control of the OpenAPI specification used by the generator, the attack vector is local to the build or code generation environment. The EPSS score of 1% indicates a low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no publicly documented exploitation at this time. Nonetheless, executing generated code in untrusted environments can lead to compromise of the machine running the generator.