Executive brief
Microsoft Kiota is a tool used by developers to automatically generate software code (SDKs) from API specifications. A security flaw in the Python code generator allows a malicious API specification to inject hidden commands into the generated code. If a developer or automated system builds and then runs this generated code, it could lead to the theft of passwords, secret keys, or sensitive source code.
Technical details
A code generation literal injection vulnerability exists in the Kiota Python generator due to improper sanitization of enum value descriptions. Specifically, the 'x-ms-enum.values[].description' field in an OpenAPI specification can contain unsanitized newline characters that escape Python comment contexts. This occurs because 'KiotaBuilder.SetEnumOptions' fails to call 'CleanupDescription' and 'PythonConventionService.RemoveInvalidDescriptionCharacters' does not strip carriage return or newline characters. An attacker can provide a malicious specification that, when processed, generates Python files containing arbitrary code at the module scope. This code executes automatically when the generated module is imported in a developer's environment or CI/CD pipeline. The issue is fixed in version 1.32.0.
Affected products
- Microsoft Microsoft.OpenAPI.Kiota < 1.32.0
- Microsoft Microsoft.OpenAPI.Kiota.Builder < 1.32.0
Timeline
- 2026-06-30: disclosed
- 2026-07-16: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory published