CyberRota Analysis
AI-GeneratedThe Kiota Python generator prior to version 1.32.0 is vulnerable due to insufficient sanitization of attacker-controlled enum value descriptions, which can lead to the execution of arbitrary Python code when generated modules are imported. This vulnerability poses a significant risk, as it allows attackers to manipulate inline comments to execute malicious code at the module scope. Organizations using Kiota for Python code generation should prioritize updating to version 1.32.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.32.0.