Executive brief
Microsoft Kiota is a tool used by developers to automatically generate API client code. A vulnerability in the Ruby code generator allows an attacker to inject malicious code into the generated client by providing a specially crafted OpenAPI specification file. If this generated code is deployed, it could lead to unauthorized code execution on production servers or within development pipelines.
Technical details
The Kiota Ruby code generator fails to properly escape the '#' character when embedding string values from OpenAPI default fields and property names into Ruby double-quoted string literals. Because Ruby evaluates string interpolation (e.g., #{expr}) within double-quoted strings at runtime, an attacker who controls an OpenAPI specification can inject arbitrary Ruby code into the generated model classes. The root cause is located in the SanitizeForQuotedLiteral() function within Writers/StringExtensions.cs. This vulnerability is particularly critical for CI/CD pipelines that automatically consume untrusted or remote OpenAPI specifications. Users should upgrade to version 1.32.0 or later and regenerate existing clients.
Affected products
- Microsoft Microsoft.OpenAPI.Kiota < 1.32.0
- Microsoft Microsoft.OpenAPI.Kiota.Builder < 1.32.0
Timeline
- 2026-06-30: disclosed: Initial disclosure by baywet
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory published