CVE-2026-105801 · GHSA-5293-mq8x-g3xj

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Risk score: 61/100
CVSS: 8.4 v4.0
Exploit chance (30 days): 0.1%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that exec…
Affected: openapi-python-client (pip) < 0.29.1
Fix: Upgrade openapi-python-client to 0.29.1 or later.
Exploitation: No known exploitation

Why it is Amber

CVSS 8.4 high
On your watchlist: python, PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
openapi-python-client	pip	< 0.29.1	0.29.1

References

Original description

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

Last activity 6 Oct 2026. Patch Forecast updates every hour.