Microsoft Kiota versions <1.29.1 and >=1.30.0 <1.31.1 suffer from a code generation literal injection vulnerability (CWE-94). When malicious input from an OpenAPI description is emitted into generated source code without context-appropriate escaping, attackers can break out of string literals and inject arbitrary code into generated clients. This affects multiple writer sinks such as serialization keys, path/query parameters, URL templates, enum/property metadata, and default values. Exploitation requires using an untrusted or compromised OpenAPI description. The issue is resolved by upgrading to Kiota 1.29.1, 1.31.1, or later and regenerating clients.

If an attacker can supply or tamper with the OpenAPI description used for client generation, they can inject arbitrary code into the generated client source code. This can lead to execution of attacker-controlled code when the generated client is compiled and run. The risk is significantly reduced if only trusted and integrity-protected OpenAPI descriptions are used. There are no known exploits in the wild at this time.

Upgrade Kiota to version 1.31.1 or later, which contains the fix for this vulnerability. Additionally, regenerate or refresh any previously generated clients using the updated Kiota version to replace vulnerable generated code. This ensures that all generated source code is hardened against this injection issue.