EUVD-2026-25094
GHSA-2hx3-vp6r-mg3f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.31.1 or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
AnalysisAI
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descriptions to inject malicious code into generated HTTP client libraries. Exploitation requires developers to generate clients from untrusted or compromised OpenAPI specifications, then compile and execute the poisoned code. The attack chain culminates in arbitrary code execution within the context of applications using the tainted generated clients. CVSS 7.3 with local attack vector and user interaction required suggests lower immediate urgency, though EPSS data is unavailable. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
Kiota is Microsoft's OpenAPI-based code generator that produces strongly-typed HTTP client libraries from API specifications. The vulnerability stems from insufficient output encoding when emitting literal values from OpenAPI documents into generated source code. CWE-94 (Improper Control of Generation of Code) indicates the root cause: user-controlled data from OpenAPI fields (property names, enum values, default values, path parameters, serialization keys) is incorporated into code templates without context-aware escaping. Attackers can embed string-breaking sequences and code fragments in malicious OpenAPI descriptions. When developers run Kiota against such descriptions, the generator produces source files containing injected code. The CPE string cpe:2.3:a:microsoft:kiota identifies all Kiota versions below 1.31.1 as vulnerable across multiple language output targets (C#, TypeScript, Java, Python, Go, PHP, Swift).
RemediationAI
Upgrade Kiota to version 1.31.1 or later from the official GitHub releases at github.com/microsoft/kiota/releases or via package managers (NuGet for .NET, npm for TypeScript tooling). After upgrading the generator, regenerate all existing HTTP client libraries as previously generated code may contain vulnerable output from earlier Kiota versions - the upgrade alone does not remediate deployed clients. Review OpenAPI description sources and implement integrity verification: download specifications over HTTPS with certificate validation, verify cryptographic signatures from API vendors when available, and maintain an allowlist of trusted API description repositories. As a compensating control until upgrade, restrict Kiota generation to a sandboxed environment separate from production development systems, and perform code review and static analysis on all generated client code before integration - though this is labor-intensive and error-prone compared to upgrading. Avoid generating clients from user-submitted or externally contributed OpenAPI files without thorough manual security review. For air-gapped environments where immediate upgrade is infeasible, implement process controls requiring security team approval before introducing new generated clients into the build pipeline.
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
We need to produce a JSON object. All fields are plain text strings. We must synthesize from all provided data. We have
We need to produce a comprehensive JSON analysis. The user asks for a senior vulnerability analyst synthesis across mult
Code injection in Microsoft Kiota Ruby code generator allows remote code execution through crafted OpenAPI specification
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today