The Kiota Ruby code generator improperly handles the # character in string literals derived from OpenAPI specification default fields and property names. Since Ruby evaluates expressions like #{expr} inside double-quoted strings, an attacker controlling the OpenAPI spec can inject arbitrary Ruby code into generated client models. The root cause is the SanitizeForQuotedLiteral() function failing to escape # characters. This vulnerability can lead to arbitrary code execution when the generated code is used, particularly in production environments. The issue affects Kiota versions prior to 1.32.0. Microsoft has released patches in versions 1.29.1 and 1.32.0 to address this problem. Workarounds include auditing and sanitizing OpenAPI specs, code reviewing generated files, restricting spec sources to trusted origins, isolating generated code from production, and manually escaping # characters if immediate upgrade is not possible.

This vulnerability allows arbitrary Ruby code execution via malicious OpenAPI specifications when the generated Ruby client code is used. The severity is critical if the vulnerable generated code reaches production, high in CI/CD environments with access to production secrets, medium for public third-party specs, and low if specs are developer-controlled. Exploitation could lead to unauthorized code execution within the context of the generated client application.

Upgrade Microsoft Kiota to version 1.29.1, 1.32.0, or later to apply the official fix. Regenerate all existing Ruby clients using the updated Kiota to replace vulnerable generated code. If immediate upgrade is not possible, audit and sanitize OpenAPI specification files to remove or replace # characters in default values and property names. Implement mandatory code reviews of generated Ruby files to detect suspicious string interpolation patterns. Restrict OpenAPI specs to trusted internal sources and avoid automatic generation from untrusted external specs. Do not deploy generated Ruby code to production unless the specification source is verified and reviewed. As a temporary measure, manually escape # characters in generated string literals by replacing # with \#.