Kiota versions <1.29.1 and >=1.30.0 <1.32.3 are vulnerable to a code injection flaw (CWE-94) in the C# XML documentation comment sink. The vulnerability arises because newline and Unicode line-terminator characters in OpenAPI description fields (such as description, externalDocs label, and link) are not stripped before being emitted as /// comments. An attacker controlling or tampering with the OpenAPI description can inject code that escapes the comment context and becomes part of the generated C# client source code. This malicious code executes during the build process of the client. The issue is mitigated by upgrading to Kiota versions 1.29.1, 1.32.3, or later, which sanitize these inputs by removing problematic characters before code generation.

If exploited, an attacker can inject arbitrary C# code into the generated client source code, which will execute when the client is built by developers or CI systems. This can lead to execution of malicious code such as launching processes or other harmful actions. The vulnerability requires the OpenAPI description to be untrusted or compromised, limiting the risk to scenarios where API specifications are sourced from attackers or tampered with. There is no indication of active exploitation in the wild.

Upgrade Kiota to version 1.32.3 or later. Additionally, regenerate or refresh any previously generated clients to replace vulnerable code with the fixed version that strips newline and Unicode line-terminator characters from documentation comment fields. Avoid generating clients from untrusted or tampered OpenAPI descriptions to reduce risk.