All vulnerabilities
CVE-2026-105801GHSA-5293-mq8x-g3xjPYSEC-2026-4245

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

openapi-generators openapi-python-clientpipRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.29.1Fixed versionGitHub
Published6 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 0.29.1openapi-python-client, pipGitHub
  • 0.29.1openapi-python-client, PyPIOSVpip install "openapi-python-client>=0.29.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.

Patches

Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.

Workarounds

Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.

Text from GitHub Advisory Database

Affected versions 53

  • openapi-python-client, pip< 0.29.1GitHub
  • openapi-python-clientaffected: < 0.29.1CVE List
  • openapi-python-client, PyPIfrom first release, fixed in 0.29.1OSV
  • openapi-python-client, PyPI0.1.0OSV
  • openapi-python-client, PyPI0.1.0.dev0OSV
  • openapi-python-client, PyPI0.1.1OSV
  • openapi-python-client, PyPI0.1.2OSV
  • openapi-python-client, PyPI0.10.0OSV
  • openapi-python-client, PyPI0.10.1OSV
  • openapi-python-client, PyPI0.10.2OSV
  • openapi-python-client, PyPI0.10.3OSV
  • openapi-python-client, PyPI0.10.4OSV
  • openapi-python-client, PyPI0.10.5OSV
  • openapi-python-client, PyPI0.10.6OSV
  • openapi-python-client, PyPI0.10.7OSV
  • openapi-python-client, PyPI0.10.8OSV
  • openapi-python-client, PyPI0.11.0OSV
  • openapi-python-client, PyPI0.11.1OSV
  • openapi-python-client, PyPI0.11.2OSV
  • openapi-python-client, PyPI0.11.3OSV
  • openapi-python-client, PyPI0.11.4OSV
  • openapi-python-client, PyPI0.11.5OSV
  • openapi-python-client, PyPI0.11.6OSV
  • openapi-python-client, PyPI0.12.1OSV
  • openapi-python-client, PyPI0.12.2OSV
  • openapi-python-client, PyPI0.12.3OSV
  • openapi-python-client, PyPI0.13.0OSV
  • openapi-python-client, PyPI0.13.1OSV
  • openapi-python-client, PyPI0.13.2OSV
  • openapi-python-client, PyPI0.13.3OSV
  • openapi-python-client, PyPI0.13.4OSV
  • openapi-python-client, PyPI0.14.0OSV
  • openapi-python-client, PyPI0.14.1OSV
  • openapi-python-client, PyPI0.15.0OSV
  • openapi-python-client, PyPI0.15.1OSV
  • openapi-python-client, PyPI0.15.2OSV
  • openapi-python-client, PyPI0.16.0OSV
  • openapi-python-client, PyPI0.16.1OSV
  • openapi-python-client, PyPI0.17.0OSV
  • openapi-python-client, PyPI0.17.1OSV
  • openapi-python-client, PyPI0.17.2OSV
  • openapi-python-client, PyPI0.17.3OSV
  • openapi-python-client, PyPI0.18.0OSV
  • openapi-python-client, PyPI0.19.0OSV
  • openapi-python-client, PyPI0.19.1OSV
  • openapi-python-client, PyPI0.2.0OSV
  • openapi-python-client, PyPI0.2.1OSV
  • openapi-python-client, PyPI0.20.0OSV
  • openapi-python-client, PyPI0.21.0OSV
  • openapi-python-client, PyPI0.21.1OSV
  • openapi-python-client, PyPI0.21.2OSV
  • openapi-python-client, PyPI0.21.3OSV
  • openapi-python-client, PyPI0.21.4OSV

References 6