GitHub Advisoryadvisory · PyPI

GHSA-5293-mq8x-g3xj openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

HIGH Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105801
Ecosystem
PyPI
Packages
openapi-python-client
Severity
High
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-116, CWE-150, CWE-94
Reviewed
2026-10-06

Affected packages

• PyPI openapi-python-client: < 0.29.1 → fixed in 0.29.1

Description

Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents. Workarounds Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.

Related

Alias · CVE (1)

  • CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. vulnerability

Weakness · CWE (3)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness
  • CWE-94 Improper Control of Generation of Code weakness

References