Microsoft Kiota versions before 1.32.4 contain a code injection vulnerability (CWE-94) in the PHP generator component. The vulnerability arises because the SanitizeDoubleQuote() function in Writers/StringExtensions.cs does not escape the $ character when embedding OpenAPI description fields and schema-derived strings into PHP double-quoted literals. This omission allows an attacker to craft malicious OpenAPI specifications that include interpolation constructs (${...}, $var, {$obj->prop}) which get injected as executable PHP code in the generated client code. This could lead to arbitrary code execution when the generated PHP code is run. The vulnerability is resolved in Kiota version 1.32.4.

An attacker who can influence the OpenAPI description or schema inputs used by Kiota's PHP generator can inject arbitrary PHP code into the generated client code. This could lead to remote code execution when the generated code is executed, posing a significant security risk. The CVSS 4.0 base score is 8.7 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impacts on confidentiality, integrity, and availability.

Upgrade to Kiota version 1.32.4 or later, where this vulnerability is fixed by properly escaping the $ character in PHP double-quoted literals. No other mitigation is indicated or required as the fix is available.