CVE-2026-105801CWE-116CWE-150CWE-94code-injection

CVE-2026-105801

published October 6, 2026

CVSS
8.4
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00139 · 2.9th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-06T19:17Z
References (4)
https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186 · [email protected]https://github.com/openapi-generators/openapi-python-client/pull/1483 · [email protected]https://github.com/openapi-generators/openapi-python-client/releases/tag/v0.29.1 · [email protected]https://github.com/openapi-generators/openapi-python-client/security/advisories/GHSA-5293-mq8x-g3xj · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 14:53Z
    openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
    cvelistv5