p PatchFirst

CVE-2026-105801

CVE-2026-105801 · openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

CVSS 8.4 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • openapi-python-client

    Versions
    • < 0.29.1: Affected

    No fix published

  • openapi-python-client PyPI

    Versions
    • 0.1.0
    • 0.1.0.dev0
    • 0.1.1
    • 0.1.2
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.10.4
    • 0.10.5
    • 0.10.6
    • 0.10.7
    • 0.10.8
    • 0.11.0
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.11.4
    • 0.11.5
    • 0.11.6
    • 0.12.1
    • 0.12.2
    • 0.12.3
    • 0.13.0
    • 0.13.1
    • 0.13.2
    • 0.13.3
    • 0.13.4
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.15.1
    • 0.15.2
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.18.0
    • 0.19.0
    • 0.19.1
    • 0.2.0
    • 0.2.1
    • 0.20.0
    • 0.21.0
    • 0.21.1
    • 0.21.2
    • 0.21.3
    • 0.21.4
    • 0.21.5
    • 0.21.6
    • 0.21.7
    • 0.22.0
    • 0.23.0
    • 0.23.1
    • 0.24.0
    • 0.24.1
    • 0.24.2
    • 0.24.3
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.25.3
    • 0.26.0
    • 0.26.1
    • 0.26.2
    • 0.27.0
    • 0.27.1
    • 0.28.0
    • 0.28.1
    • 0.28.2
    • 0.28.3
    • 0.28.4
    • 0.29.0
    • 0.3.0
    • 0.4.0
    • 0.4.0rc1
    • 0.4.1
    • 0.4.2
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.6.0
    • 0.6.0a1
    • 0.6.0a2
    • 0.6.0a3
    • 0.6.0a4
    • 0.6.1
    • 0.6.2
    • 0.7.0
    • 0.7.0rc0
    • 0.7.0rc1
    • 0.7.0rc2
    • 0.7.0rc3
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.8.0
    • 0.9.0
    • 0.9.1
    • 0.9.2
    Affected ranges
    • ECOSYSTEM: < 0.29.1

    Update to 0.29.1

Original sources

Check your server →