The Kiota PHP code generator improperly handles string interpolation in PHP double-quoted literals by failing to escape the '$' character in OpenAPI schema-derived strings such as descriptions, default values, and property names. This allows an attacker controlling an OpenAPI specification to inject arbitrary PHP code into generated model and request-builder classes. The root cause is the SanitizeDoubleQuote() function in Writers/StringExtensions.cs, which does not escape '$', enabling runtime evaluation of interpolation expressions. The vulnerability affects Kiota versions prior to 1.32.4 and was addressed in pull request #7863.

If exploited, this vulnerability can lead to arbitrary PHP code execution in applications using generated clients from untrusted OpenAPI specifications. This is critical when vulnerable generated code is deployed to production environments, potentially compromising application integrity and confidentiality. It is also high risk in CI/CD pipelines that automatically regenerate code from remote specs with access to production secrets. The severity is medium for public third-party specs and low for developer-controlled specs.

Upgrade Microsoft Kiota to version 1.29.1, 1.32.4, or later to obtain the official fix. Regenerate all existing PHP clients to replace vulnerable generated code with patched output. If immediate upgrade is not possible, audit and sanitize OpenAPI specifications to remove or replace '$' characters in strings, conduct mandatory code reviews of generated PHP files to detect interpolation patterns, restrict OpenAPI specs to trusted sources, avoid deploying generated code to production without verification, and manually escape '$' characters in generated files as a temporary measure.