Kiota, an OpenAPI-based HTTP client code generator by Microsoft, has a code injection vulnerability (CWE-94) in versions before 1.32.3. The vulnerability arises from improper handling of newline and Unicode line-terminator characters in OpenAPI description fields that are emitted as single-line XML documentation comments in generated C# code. An attacker can exploit this by injecting malicious code that breaks out of the comment context, potentially leading to arbitrary code execution in generated clients. The vulnerability is addressed in Kiota version 1.32.3.

Successful exploitation allows an attacker to inject arbitrary code into the generated C# client code, which could lead to execution of malicious code when the client is compiled and run. This poses a high security risk as it compromises the integrity and trustworthiness of the generated client code.

Upgrade Kiota to version 1.32.3 or later, where this code injection vulnerability has been fixed. No other official remediation or temporary fixes are documented. Users should avoid using affected versions prior to 1.32.3.