CVE-2025-5982: Microsoft Kiota Python Generator Code Injection Vulnerability

Vulnerability Overview Vulnerability Name: Code Generation Literal Injection in Kiota Python Generator Description: The Kiota Python code generator is vulnerable to code generation literal injection when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions (from x-ms-enum value descriptions) can leak into the generated Python file without proper escaping, allowing the injected content to execute at the module level. Impact Scope Affected Versions: - Microsoft.OpenApi.Kiota: < 1.32.0 - Microsoft.OpenApi.Kiota.Builder: < 1.32.0 Potential Impact: - Arbitrary code execution - Credential leakage - Leakage of environment variables and secrets - Source code leakage - Persistence through generated client output - Risk for developers generating Python SDKs - Risk when generating clients in CI/CD automation Remediation Patch: - Upgrade to Kiota version 1.32.0 or higher. Temporary Workarounds: - Generate only from trusted, internally controlled OpenAPI specification sources. - Disable or restrict automatic generation from remote specifications. - Add validation/cleaning prior to generation. - Review generated Python files for suspicious top-level statements. - Perform generation and validation in an isolated environment. Exploitation Path Malicious newlines are emitted within the x-ms-enum description. Generated inline comments are split by newlines. Subsequent attacker-controlled lines are executed in the generated file. Attack Vectors OpenAPI specifications hosted on attacker-controlled URLs. Supply chain scenarios where third-party specifications are automatically consumed. CI pipelines generating, importing, or testing generated Python clients. Recommended Verification Regenerate from the same specification for proof-of-concept testing. Confirm that malicious multi-line enum descriptions no longer produce executable top-level output. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2025-5982 Credits: baywet Remediation reviewer: baywet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-5982: Microsoft Kiota Python Generator Code Injection Vulnerability

More from this source