EUVD-2026-44931
GHSA-3hrf-2gc2-mx32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious spec is network-fetched (AV:N) with low complexity and no auth (PR:N), but a developer must run generation and build (UI:R); full code execution yields C/I/A:H, scope kept unchanged to match vendor SC:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C
XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C
clients. This issue is fixed in version 1.32.3.
AnalysisAI
We need to produce a comprehensive JSON analysis. The user asks for a senior vulnerability analyst synthesis across multiple intelligence sources. The provided data includes CVE description, CVSS (4.0 vector), CWE-94, EPSS 1.02% (59th percentile), patch available, CPE, tags (RCE, Code Injection, Kiota), SSVC: exploitation POC, automatable yes, technical impact total. References: GitHub security advisory, PR, commit, release tag, VulDB, NVD, EUVD. Source code evidence from PR diff.
We must extract product_name: "Kiota" (Microsoft Kiota, but simply "Kiota" is fine; "Microsoft Kiota" is three words, but the rule says "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description." So product name is "Kiota". Could also be "Microsoft Kiota" (2-3 words). I'll go with "Microsoft Kiota" (2 words) to be precise, but the examples show "Apache Tomcat", "GoAnywhere MFT". So "Microsoft Kiota" is appropriate. That is exactly the product. The vulnerability is in the C
code generator. Affected package: nuget/Microsoft.OpenApi.Kiota and Builder. So product_name: "Microsoft Kiota". That's 2 words, okay.
Summary: Need to synthesize, not copy description. Start with impact verb and product. E.g., "Code injection in Microsoft Kiota allows attackers to inject arbitrary C
code into generated HTTP clients." Must include version affected (<1.32.3), what attacker can do. Mention if actively exploited (KEV status isn't provided, but tags include RCE, but KEV is not listed. The input does not have a KEV field. So we should not claim KEV. The SSVC says exploitation: poc, meaning proof-of-concept exists. That's public but not actively exploited per KEV. So I'll state "publicly available exploit code exists" because SSVC says poc and advisory includes an example, and PR has tests showing injection. So summary: "Code injection in Microsoft
Command injection in Microsoft Kiota before 1.32.5 lets a malicious or compromised OpenAPI description dictate the insta
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `stat
We need to produce a JSON object. All fields are plain text strings. We must synthesize from all provided data. We have
Code injection in Microsoft Kiota Ruby code generator allows remote code execution through crafted OpenAPI specification
Code injection in Microsoft Kiota's Python client generator (versions prior to 1.32.0) allows an attacker who controls a
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-contr
Code injection in Microsoft Kiota versions prior to 1.31.1 allows attackers who control or tamper with OpenAPI descripti
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 all
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today