GitHub Advisoryadvisory · PyPI

GHSA-9x4c-63pf-525f openapi-python-client Arbitrary Code Generation vulnerability

HIGH Published 2020-08-20 Modified 2024-10-07 Official page ↗
Aliases
CVE-2020-15142
Ecosystem
PyPI
Packages
openapi-python-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2020-08-14

Affected packages

• PyPI openapi-python-client: < 0.5.3 → fixed in 0.5.3

Description

Impact Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C . Patches Fix will be included in version 0.5.3 Workarounds Inspect OpenAPI documents before generating, or inspect generated code before executing. For more information If you have any questions or comments about this advisory: • Open an issue in openapi-python-client • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-15142 In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References