Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

This issue is only practically exploitable when:

1. the OpenAPI description used for generation is from an untrusted source, or
2. a normally trusted OpenAPI description has been compromised/tampered with.

The injected code is compiled (and may execute) when the developer or CI builds the generated client. If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.

• Affected: all versions < 1.32.3
• Fixed: 1.32.3 and later

Example OpenAPI fragment (malicious description)

 1openapi: 3.0.1
 2info:
 3  title: Exploit Demo
 4  version: 1.0.0
 5  description: |-
 6    Legitimate summary text
 7    public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }

The newline inside description (also exploitable via \r, U+0085, U+2028, U+2029) terminates the doc-comment line.

Example generated C# snippet before fix (illustrative)

 1/// Legitimate summary text
 2public static class Pwned { static Pwned() { System.Diagnostics.Process.Start("calc.exe"); } }

The injected payload escapes the intended /// comment context and introduces attacker-controlled statements in generated code.

Note: this exploit is not limited to the description field, but may also impact the externalDocs label and link text and other doc-comment-derived locations.

1. Upgrade Kiota to 1.32.3 or later.
2. Regenerate/refresh existing generated clients as a precaution:

Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output. The fix (PR microsoft/kiota#7831) strips \r, \n, \u0085, \u2028, \u2029 (and normalizes tabs) from description, label, and link text before emitting doc comments.