Microsoft Kiota, an OpenAPI-based HTTP client code generator, suffers from a CWE-94 improper control of code generation vulnerability in versions before 1.31.1. The vulnerability occurs when malicious input from OpenAPI descriptions is injected into generated source code without proper context-aware escaping across multiple writer sinks such as serialization keys, URL templates, and metadata. This allows attackers to break out of string literals and inject arbitrary code into generated clients. Exploitation is feasible only if the OpenAPI description is untrusted or tampered with. The recommended fix is to upgrade to Kiota 1.31.1 or later and regenerate any previously generated clients to ensure hardened code output.

This vulnerability enables code injection into generated client code, potentially allowing execution of arbitrary code within the context of the generated client. However, exploitation requires the attacker to control or compromise the OpenAPI description used for code generation. There are no known exploits in the wild. The impact is rated high with a CVSS score of 7.3, reflecting the potential for significant code execution risk if the conditions for exploitation are met.

Upgrade Microsoft Kiota to version 1.31.1 or later to address the code injection vulnerability. Additionally, regenerate or refresh all previously generated client code to replace any vulnerable code with the fixed version. Avoid generating clients from untrusted or tampered OpenAPI descriptions to significantly reduce risk. Patch status is not explicitly stated as 'official-fix' in the advisory, but upgrading to 1.31.1 is the recommended remediation.