En bref
- CVE-2026-105801 est une vulnérabilité ÉLEVÉE (CVSS 8.4) touchant openapi-python-client.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.14%, plus élevée que 3.3% des vulnérabilités.
- Correctif : mettre à jour vers 0.29.1 ou plus récent.
Description
Impact
A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.
Patches
Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.
Workarounds
Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.
NVD description
openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.
Autres vulnérabilités de openapi-python-client
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free