Arbitrary Code Injection Affecting microsoft.openapi.kiota package, versions [,1.32.4)

Affected versions of this package are vulnerable to Arbitrary Code Injection through the string escaping logic in StringExtensions and the PHP writers that emit double-quoted literals. An attacker can inject and execute arbitrary PHP code in generated model and request-builder classes by supplying an OpenAPI specification with $-prefixed content in descriptions, enum values, content types, discriminator names, query parameter names, or similar schema-derived strings. The vulnerable code writes those values into PHP double-quoted strings without escaping $, so PHP interpolates expressions such as ${...} or $var when the generated client runs. This can turn untrusted specs into generated client code that executes attacker-controlled PHP or OS commands, breaking applications that build or deploy clients from external specifications.

Notes

• OpenAPI-derived strings in PHP generator output are especially risky when they land in code paths that emit enum constants, request-body content types, Accept headers, discriminator lookups, or @QueryParameter annotations; those values are compiled into generated client classes rather than handled only at generation time.
• The maintainer advisory ties impact to external or untrusted specifications, including CI/CD jobs that regenerate clients from remote specs and teams that deploy the generated PHP artifacts to production.

Workarounds

• Audit OpenAPI specifications for $ in description, default values, and property names before generating PHP clients; remove or replace suspicious strings so they cannot be emitted into PHP double-quoted literals.
• Require code review of generated PHP files before merging; look specifically for double-quoted strings containing ${, $var, or {$ patterns to catch interpolation-based injection.
• Restrict code generation to trusted internal OpenAPI sources and avoid automatically generating PHP clients from external or third-party specs until you can upgrade.
• Do not deploy generated PHP models or request builders to production unless the source specification has been verified and reviewed, limiting the blast radius if generated code is malicious.
• If you cannot regenerate immediately, manually edit generated PHP files to escape $ characters in double-quoted string literals by replacing $ with \$ so PHP will not interpolate attacker-controlled expressions.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory