EUVD-2026-44926
GHSA-xg2h-5xr2-29jw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted OpenAPI input yields arbitrary Ruby code execution (C/I/A:H), but a developer must actively run generation against the malicious spec, so UI:R; no attacker privileges needed (PR:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.32.0.
AnalysisAI
Code injection in Microsoft Kiota Ruby code generator allows remote code execution through crafted OpenAPI specifications. Kiota versions prior to 1.32.0 fail to escape '#' characters in schema-derived strings embedded in Ruby double-quoted literals, enabling Ruby interpolation sequences such as '#{code}' to execute arbitrary commands when the generated client code runs. While no active exploitation is confirmed, the attack is automatable, EPSS indicates moderate probability (1.47%), and the vendor has released a fix.
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
PHP code generation in Microsoft Kiota prior to 1.32.4 permits injection of arbitrary PHP code when the generator proces
Code-generation injection in Microsoft Kiota's C# XML documentation-comment writer allows an attacker who controls or co
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today