GHSA-2hx3-vp6r-mg3f Kiota: Code Generation Literal Injection

• NuGet Microsoft.OpenApi.Kiota: >= 1.30.0, < 1.31.1 → fixed in 1.31.1 • NuGet Microsoft.OpenApi.Kiota.Builder: >= 1.30.0, < 1.31.1 → fixed in 1.31.1 • NuGet Microsoft.OpenApi.Kiota: < 1.29.1 → fixed in 1.29.1 • NuGet Microsoft.OpenApi.Kiota.Builder: < 1.29.1 → fixed in 1.29.1

CVE Advisory (CVE-2026-41134): Code Generation Literal Injection in Kiota Summary Kiota versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. Impact and Preconditions This issue is only practically exploitable when: 1. the OpenAPI description used for generation is from an untrusted source, or 2. a normally trusted OpenAPI description has been compromised/tampered with. If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced. Affected Versions • Affected: all versions = 1.30.0, Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations. Remediation 1. Upgrade Kiota to 1.31.1 or later**. 2. Regenerate/refresh existing generated clients as a precaution: ```bash kiota update ``` Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output. Acknowledgement We would like to thank the researcher Thanatos Tian（Polyu) for finding this issue and for his contribution to this open source project.