Microsoft Kiota versions before 1.32.5 do not properly sanitize the x-ms-kiota-info clientClassName and clientNamespaceName values when generating client code. When the 'kiota generate' command runs without specifying a class name, these unsanitized values are used both as generated client class or namespace names and as components of the output file path. This improper limitation of pathname allows an attacker-controlled or compromised OpenAPI description to cause path traversal, writing files outside the designated output directory and injecting arbitrary text into generated source code. The vulnerability is addressed in version 1.32.5 by implementing GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName to sanitize these values.

An attacker who can supply or modify the OpenAPI description used by Kiota can exploit this vulnerability to write files outside the intended output directory during code generation. This can lead to arbitrary code injection in generated client classes or namespaces, potentially compromising the build environment or downstream consumers of the generated code. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade Microsoft Kiota to version 1.32.5 or later, where the vulnerability is fixed by sanitizing client class and namespace names. Until upgrading, avoid generating code from untrusted or attacker-controlled OpenAPI descriptions. No other official fixes or temporary mitigations are documented. Patch status is confirmed fixed in 1.32.5.