CyberRota Analysis
AI-GeneratedPrior to version 1.32.5, Kiota's `kiota info` command was vulnerable to command injection due to improper handling of dependency installation commands sourced from OpenAPI descriptions. An attacker could exploit this vulnerability by providing a malicious OpenAPI spec, leading to potential execution of arbitrary commands when users manually executed the suggested install command or used the Kiota VS Code extension. Developers and organizations utilizing Kiota for API client generation should prioritize upgrading to version 1.32.5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.32.5.