Arbitrary Code Injection Affecting microsoft.openapi.kiota package, versions [,1.32.0)

Affected versions of this package are vulnerable to Arbitrary Code Injection via CodeMethodWriter in CodeMethodWriter.cs and RubyConventionService in RubyConventionService.cs. An attacker can inject arbitrary Ruby code into generated client classes by supplying an OpenAPI specification with # characters in schema default values, discriminator names, mapped type keys, serialization names, or wire names that are embedded into Ruby double-quoted string literals. Generated Ruby code evaluates interpolation syntax inside those literals at runtime, so malicious schema-derived strings can alter constructor defaults, serializer/deserializer mappings, and other emitted model logic. When teams generate clients from untrusted or externally sourced specs, the resulting code can execute attacker-controlled Ruby in the build or deployment environment, compromising systems that run the generated client.

Notes

• The vulnerable literals are generated in code paths for discriminator handling, serializer/deserializer mappings, constructor defaults, and query/path parameter dictionaries; specs that do not exercise those schema-derived outputs are not exposed through this issue.
• The maintainer advisory’s impact is tied to teams that generate and then run or deploy the generated Ruby client from untrusted OpenAPI sources, including CI/CD jobs that refresh clients automatically from remote specs.

Workarounds

• Audit and sanitize OpenAPI specifications before generating Ruby clients: remove or replace any # characters in default values, property names, discriminator names, mapped type keys, serialization names, and wire names to prevent Ruby interpolation from being embedded into generated code.
• Restrict client generation to trusted internal OpenAPI sources and avoid automatic regeneration from external or third-party specs until you can upgrade, which reduces exposure to malicious schema-derived strings.
• Add mandatory code review for generated Ruby files before merging or deploying them, and reject output containing double-quoted literals with #{, #$, or #@, which helps catch injected interpolation payloads before they run.
• Keep generated Ruby models out of production until the spec has been verified and reviewed, limiting the blast radius if malicious code is generated.
• If you cannot regenerate immediately, manually edit generated Ruby files to escape # as \# inside double-quoted string literals, which blocks runtime interpolation in the affected output.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory