{"schema":"threatline.record/2","record":{"id":"CVE-2026-105801","aliases":["GHSA-5293-mq8x-g3xj","PYSEC-2026-4245"],"summary":"openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation","details":"### Impact\nA malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.\n\n### Patches\nVersions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.\n\n### Workarounds\nDo not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.","categories":["Runtimes & languages"],"product":"openapi-python-client","vendor":"openapi-generators","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5293-mq8x-g3xj","source_modified_at":"2026-10-06T15:32:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"openapi-python-client"},"range":"< 0.29.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105801","source_modified_at":"2026-10-09T01:06:15.915Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"openapi-python-client","vendor":"openapi-generators","versions":[{"version":"< 0.29.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5293-mq8x-g3xj","source_modified_at":"2026-10-15T14:55:35.768688332Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"openapi-python-client","ecosystem":"PyPI","purl":"pkg:pypi/openapi-python-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.1"}]}],"versions":["0.1.0","0.1.0.dev0","0.1.1","0.1.2","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.12.1","0.12.2","0.12.3","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.17.3","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.20.0","0.21.0","0.21.1","0.21.2","0.21.3","0.21.4"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-5293-mq8x-g3xj","source_modified_at":"2026-10-06T15:32:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"openapi-python-client"},"version":"0.29.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-5293-mq8x-g3xj","source_modified_at":"2026-10-15T14:55:35.768688332Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"openapi-python-client","ecosystem":"PyPI","purl":"pkg:pypi/openapi-python-client"},"version":"0.29.1"}],"cvss":8.4,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00139,"percentile":0.02948,"score_date":"2026-10-23"},"published_at":"2026-10-06T14:53:42.461Z","modified_at":"2026-10-15T14:55:35.768688332Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-5293-mq8x-g3xj","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:32:54Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105801","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T01:06:15.915Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-5293-mq8x-g3xj","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:55:35.768688332Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105801","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/openapi-generators/openapi-python-client/security/advisories/GHSA-5293-mq8x-g3xj","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105801","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/openapi-generators/openapi-python-client/pull/1483","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/openapi-generators/openapi-python-client/releases/tag/v0.29.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-5293-mq8x-g3xj","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-09T01:06:05.721882Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:35.768688332Z","content_hash":"73275a479e9c46f5e4b84469cef356417e8afb257b048278de8d9a9cf478dd2a"}}