CyberRota Analysis
AI-GeneratedKiota, an OpenAPI-based HTTP client code generator, is vulnerable to a code-generation injection flaw in its C# XML documentation-comment sink prior to version 1.32.3. This vulnerability allows attackers to inject malicious code into generated C# clients by exploiting improperly handled newline and Unicode line-terminator characters in the documentation comments. Developers and organizations using Kiota for C# client generation should prioritize upgrading to version 1.32.3 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.32.3.