https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T08:39:57.021972+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-105801 fkie_cve-2026-105801 2026-10-08T08:39:57.023216+00:00

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

 https://vulnerability.circl.lu/vuln/ghsa-5293-mq8x-g3xj GHSA-5293-mq8x-g3xj — openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation 2026-10-08T08:39:57.023282+00:00

Affected: PyPI: openapi-python-client

### Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.

### Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.

### Workarounds Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.