What’s Vulnerable › Vulnerabilities

CVE-2026-105801: openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

• Severity: high (CVSS 8.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-09
• Weakness: CWE-94

Description

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

Affected products

• openapi-generators openapi-python-client: before 0.29.1

References

• https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186
• https://github.com/openapi-generators/openapi-python-client/pull/1483
• https://github.com/openapi-generators/openapi-python-client/releases/tag/v0.29.1
• https://github.com/openapi-generators/openapi-python-client/security/advisories/GHSA-5293-mq8x-g3xj

Get alerted when CVE-2026-105801 or the next vulnerability affects your stack