Microsoft Kiota, an OpenAPI-based HTTP client code generator, is affected by a code-generation literal injection vulnerability (CWE-94) in versions before 1.31.1. This vulnerability occurs when malicious inputs from OpenAPI descriptions are emitted into generated source code without proper context-appropriate escaping across multiple writer sinks such as serialization keys, URL templates, and metadata. An attacker can exploit this by injecting code into generated clients if the OpenAPI description is untrusted or compromised. The vulnerability is mitigated by upgrading to Kiota 1.31.1 or later and regenerating clients to ensure hardened code output.

The vulnerability allows attackers to inject arbitrary code into generated client source code, potentially leading to execution of malicious code within the client environment. However, exploitation is limited to scenarios where the OpenAPI description used for generation is untrusted or tampered with. There are no known exploits in the wild at this time. The CVSS 4.0 score of 7.3 reflects a high severity with local attack vector, low attack complexity, and partial user interaction required.

Upgrade Microsoft Kiota to version 1.31.1 or later. After upgrading, regenerate or refresh all existing generated clients to replace any previously vulnerable code with the fixed, hardened output. Additionally, only use trusted and integrity-protected OpenAPI descriptions for code generation to significantly reduce risk. Patch status is not explicitly stated as 'official-fix' in the advisory, but the vendor-provided upgrade version indicates a fix is available.