In short
- CVE-2026-105801 is a HIGH (CVSS 8.4) vulnerability affecting openapi-python-client.
- Chance of exploitation in the next 30 days (EPSS): 0.14%, higher than 3.3% of all vulnerabilities.
- Fix: update to 0.29.1 or later.
Description
Impact
A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.
Patches
Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.
Workarounds
Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.
NVD description
openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.
More vulnerabilities in openapi-python-client
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free