CVE-2020-15142CWE-94

Arbitrary Code Generation

High · published August 14, 2020

CVSS v3.1
8.0
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01849 · 78.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2020-08-14T16:20Z
EPSS history
Timeline
  • 14 AUG 16:20Z
    Arbitrary Code Generation
    cvelistv5