https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:39:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-105801 <p>openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment&#39;s integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.</p> <p>openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment&#39;s integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-105801 https://vulnerability.circl.lu/vuln/ghsa-5293-mq8x-g3xj <p><strong>Affected:</strong> PyPI: openapi-python-client</p> <p>### Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.</p> <p>### Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.</p> <p>### Workarounds Do not generate clients for documents you don&#39;t completely trust. Carefully verify any existing generated code from untrusted documents.</p> <p><strong>Affected:</strong> PyPI: openapi-python-client</p> <p>### Impact A malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.</p> <p>### Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.</p> <p>### Workarounds Do not generate clients for documents you don&#39;t completely trust. Carefully verify any existing generated code from untrusted documents.</p> https://vulnerability.circl.lu/vuln/ghsa-5293-mq8x-g3xj