Executive brief
Microsoft Kiota, a tool used to generate API client code, contains a vulnerability that allows malicious code to be hidden within API descriptions. If a developer uses a compromised or untrusted API specification to generate their code, the tool may inadvertently include and execute harmful commands during the software build process. This could lead to a full system compromise of the developer's environment or the final application.
Technical details
A code injection vulnerability exists in Microsoft Kiota's C# code generation engine due to improper sanitization of input from OpenAPI descriptions. Specifically, the 'description', 'externalDocs' label, and 'externalDocs' link fields are emitted into single-line XML documentation comments (///) without stripping newline (\r, \n) or Unicode line-terminator characters (U+0085, U+2028, U+2029). An attacker can provide a malicious OpenAPI document containing these characters to terminate the comment context and inject arbitrary C# code. This code is then executed when the generated client is compiled by a developer or within a CI/CD pipeline. The vulnerability is fixed in version 1.32.3 by stripping these characters and normalizing tabs.
Affected products
- Microsoft Microsoft.OpenApi.Kiota < 1.32.3
- Microsoft Microsoft.OpenApi.Kiota.Builder < 1.32.3
Timeline
- 2026-06-25: disclosed: Initial report to Microsoft Kiota repository
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published and fix confirmed in 1.32.3