CyberRota Analysis
AI-GeneratedThe Kiota Ruby generator prior to version 1.32.0 is vulnerable to code injection due to improper handling of OpenAPI default fields and property names, allowing attackers to inject arbitrary Ruby code through unescaped interpolation markers. This vulnerability poses a significant risk to applications that utilize the affected generator for model class creation, potentially leading to unauthorized code execution. Developers and organizations using Kiota for Ruby code generation should prioritize upgrading to version 1.32.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.32.0.