Microsoft Kiota is an OpenAPI-based HTTP client code generator. In versions before 1.32.0, the Python generator component improperly handled attacker-controlled enum value descriptions from the x-ms-enum.values[].description field. These descriptions flowed through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without sanitizing newline characters. This flaw enabled generated inline comments to be split, allowing arbitrary Python code injection and execution at module scope when the generated modules were imported. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code). The issue is resolved in Kiota version 1.32.0.

An attacker can inject and execute arbitrary Python code in the context of the generated module by supplying malicious enum value descriptions. This can lead to arbitrary code execution at module import time, potentially compromising the environment where the generated code is used. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact on availability but no direct confidentiality or integrity impact.

This vulnerability is fixed in Kiota version 1.32.0. Users should upgrade to version 1.32.0 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix is included in version 1.32.0.