Microsoft Kiota versions before 1.32.5 contain a code injection vulnerability (CWE-94) in the 'kiota info' command. The command reads the 'x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand' field along with dependency name and version from an OpenAPI description and presents it as the recommended install command. Because this input is not properly sanitized, an attacker or compromised OpenAPI description can inject arbitrary commands that may be executed by users or through the Kiota VS Code extension's dependency-install flow. This vulnerability has a CVSS 4.0 score of 9.3 (critical). The vulnerability is fixed in Kiota version 1.32.5.

An attacker who can supply or compromise an OpenAPI description used by Kiota can cause arbitrary command injection when the suggested install command is run manually or via the Kiota VS Code extension. This can lead to execution of malicious code on the user's system without requiring user interaction or privileges. The vulnerability is critical due to its potential for remote code execution with no user interaction or privileges required.

Upgrade Microsoft Kiota to version 1.32.5 or later, where this code injection vulnerability is fixed. Avoid running dependency install commands derived from untrusted or unverified OpenAPI descriptions. Since no official patch link or advisory is provided, verify the upgrade through official Microsoft Kiota release notes or repositories.