Microsoft Kiota improperly limits pathnames to a restricted directory (CWE-22) and allows code injection into generated client declarations (CWE-94) by emitting the clientClassName and clientNamespaceName values from the x-ms-kiota-info OpenAPI extension raw and unsanitized. When generating clients without specifying a class name, an attacker controlling the OpenAPI description can cause the generation process to write files outside the designated output directory and inject arbitrary text into class or namespace declarations. This was confirmed in Kiota 1.32.4. The vulnerability does not enable remote code execution because injected code breaks the build, but it can cause integrity issues and denial of service. The issue is fixed in versions 1.29.1 and 1.32.5 by sanitizing these values to remove unsafe characters and path separators.

An attacker who controls or tampers with the OpenAPI description used by Kiota to generate client code can cause files to be written outside the intended output directory, potentially overwriting arbitrary files. Additionally, they can inject arbitrary text into the generated client code, corrupting the build process and causing denial of service. However, this vulnerability does not allow remote code execution because the injected code breaks compilation. The primary impact is integrity compromise and denial of service during client generation.

Upgrade Microsoft Kiota to version 1.29.1, 1.32.5, or later. These versions include fixes that sanitize the clientClassName and clientNamespaceName values sourced from the x-ms-kiota-info extension, removing unsafe characters and path separators to prevent path traversal and code injection. Regenerate any affected clients after upgrading. No other mitigation is required as the issue is addressed by these official fixes.