Microsoft Kiota, an OpenAPI-based HTTP client code generator, had a vulnerability in its Python generator before version 1.32.0. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description flowed through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without proper newline sanitization. This allowed generated inline comments to be split, enabling execution of attacker-controlled Python code at module scope when the generated modules were imported. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 base score of 7.5 (high). The issue is resolved in Kiota version 1.32.0.

An attacker who can control enum value descriptions in the OpenAPI specification used by Kiota's Python generator can inject and execute arbitrary Python code at module import time. This can lead to arbitrary code execution in the environment where the generated Python modules are imported. The vulnerability does not impact confidentiality or integrity directly but results in a high impact on availability due to potential arbitrary code execution.

Upgrade to Kiota version 1.32.0 or later, where this vulnerability is fixed. There is no indication of any temporary workaround or alternative mitigation. Users should ensure they do not use affected versions of Kiota's Python generator in production environments.