N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2hx3-vp6r-mg3f

GHSA-2hx3-vp6r-mg3f: Kiota: Code Generation Literal Injection

Code Generation Literal Injection in Kiota

Summary

Kiota versions prior to 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission).

When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients.

Impact and Preconditions

This issue is only practically exploitable when:

the OpenAPI description used for generation is from an untrusted source, or
a normally trusted OpenAPI description has been compromised/tampered with.

If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.

Affected Versions

Affected: all versions < 1.31.1
Fixed: 1.31.1 and later

Illustrative Exploit Example

Example OpenAPI fragment (malicious default value)

openapi: 3.0.1
info:
  title: Exploit Demo
  version: 1.0.0
components:
  schemas:
    User:
      type: object
      properties:
        displayName:
          type: string
          default: "\"; throw new System.Exception(\"injected\"); //"

Example generated C# snippet before fix (illustrative)

public User() {
    DisplayName = ""; throw new System.Exception("injected"); //";
}

The injected payload escapes the intended string context and introduces attacker-controlled statements in generated code.

Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations.

Miggo Vulnerability Database

→

GHSA-2hx3-vp6r-mg3f

GHSA-2hx3-vp6r-mg3f:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kiota	nuget	< 1.31.1	1.31.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a code generation literal injection issue affecting multiple language writers in Kiota. The root cause is the failure to properly sanitize string literals that are sourced from an OpenAPI specification before they are embedded into the generated source code. An attacker with control over the OpenAPI specification could provide malicious values for various fields such as default values, property names (wire names), URL templates, discriminator property names, and documentation descriptions. These malicious values could then break out of their intended string literal context and inject arbitrary code into the generated client, leading to Remote Code Execution (RCE) in the context of the application using the generated client.

The patch addresses this vulnerability by introducing and applying context-aware sanitization functions (SanitizeDoubleQuote, SanitizeSingleQuote, SanitizeQuotedStringLiteral) across all affected language writers. These functions escape special characters (like quotes, backslashes, and newlines) within the string literals, ensuring that the values from the OpenAPI specification are treated as data and not as executable code. The analysis of the patch shows that this vulnerability was widespread, affecting C#, Java, Python, Go, TypeScript, Ruby, PHP, and even the HTTP file generator. The identified vulnerable functions are the methods within these writers that were responsible for generating code using the unsanitized input from the OpenAPI specification.

Vulnerable functions

Kiota.Builder.Writers.CSharp.CSharpConventionService.GetParameterSignature

src/Kiota.Builder/Writers/CSharp/CSharpConventionService.cs

The `GetParameterSignature` method was vulnerable to code injection. When generating a method parameter with a default value from an OpenAPI specification, the value was directly embedded in the generated C# code without proper escaping. An attacker could craft a malicious default value in the OpenAPI spec (e.g., `\"; throw new System.Exception(\"injected\"); //`) to break out of the string literal and inject arbitrary code into the generated client. The patch mitigates this by using `SanitizeQuotedStringLiteral` to escape the default value.

Kiota.Builder.Writers.Java.CodeMethodWriter.WriteFactoryMethodBody

src/Kiota.Builder/Writers/Java/CodeMethodWriter.cs

The `WriteFactoryMethodBody` method was vulnerable to code injection. When generating a factory method for a model with a discriminator, the discriminator property name from the OpenAPI specification was used without escaping to generate code that retrieves the discriminator value from a parse node. A malicious property name could be used to inject code. The patch applies `SanitizeDoubleQuote` to escape the property name.

Kiota.Builder.Writers.Python.CodeMethodWriter.WriteRequestGeneratorBody

src/Kiota.Builder/Writers/Python/CodeMethodWriter.cs

The `WriteRequestGeneratorBody` method was vulnerable to code injection. When a request generator method had a URL template override defined in the OpenAPI specification, the value of the override was directly used in the generated Python code without escaping. This could allow an attacker to inject arbitrary Python code by crafting a malicious URL template override. The patch uses `SanitizeSingleQuote` to escape the value.

Kiota.Builder.Writers.Go.CodeEnumWriter.WriteStringFunction

src/Kiota.Builder/Writers/Go/CodeEnumWriter.cs

The `WriteStringFunction` method, which generates the `String()` method for Go enums, was vulnerable to code injection. The `WireName` for each enum option, taken from the OpenAPI specification, was used to create a string array in the generated code without being properly escaped. A malicious `WireName` could be used to inject arbitrary Go code. The patch mitigates this by using `SanitizeDoubleQuote`.

Kiota.Builder.Writers.TypeScript.CodeFunctionWriter.WriteApiConstructorBody

src/Kiota.Builder/Writers/TypeScript/CodeFunctionWriter.cs

The `WriteApiConstructorBody` method was vulnerable to code injection. The `BaseUrl` for an API client, taken from the OpenAPI specification, was directly embedded in the generated TypeScript constructor without escaping. An attacker could provide a malicious `BaseUrl` to inject arbitrary code. The patch mitigates this by using `SanitizeDoubleQuote`.

Kiota.Builder.Writers.Ruby.CodeMethodWriter.WriteDeserializerBody

src/Kiota.Builder/Writers/Ruby/CodeMethodWriter.cs

The `WriteDeserializerBody` method in the Ruby writer was vulnerable to code injection. The `WireName` of a property, taken from the OpenAPI specification, was used as a key in the deserializer hash without being escaped. A malicious `WireName` could be used to inject arbitrary Ruby code. The patch mitigates this by using `SanitizeDoubleQuote`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2hx3-vp6r-mg3f: Kiota: Code Generation Literal Injection

Code Generation Literal Injection in Kiota

Summary

Impact and Preconditions

Affected Versions

Illustrative Exploit Example

Example OpenAPI fragment (malicious default value)

Example generated C# snippet before fix (illustrative)

GHSA-2hx3-vp6r-mg3f:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

Basic Information

Basic Information

GHSA-2hx3-vp6r-mg3f: Kiota: Code Generation Literal Injection

Code Generation Literal Injection in Kiota

Summary

Impact and Preconditions

Affected Versions

Illustrative Exploit Example

Example OpenAPI fragment (malicious default value)

Example generated C# snippet before fix (illustrative)

Remediation

Acknowledgement

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI