CVE-2026-59862: Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time.

The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module is imported.

This issue requires user interaction in the form of generating a client from a malicious specification and importing the generated code, which is a common development and CI workflow.