PYSEC-2020-71

2020-08-1417:15:00

Google

osv.dev

0.002 Low

EPSS

Percentile

54.0%

JSON

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

CPENameOperatorVersion
openapi-python-clienteq0.1.0.dev0
openapi-python-clienteq0.5.2
openapi-python-clienteq0.1.2
openapi-python-clienteq0.2.0
openapi-python-clienteq0.4.0
openapi-python-clienteq0.4.2
openapi-python-clienteq0.5.1
openapi-python-clienteq0.4.0rc1
openapi-python-clienteq0.1.0
openapi-python-clienteq0.2.1

Name	Operator	Version
openapi-python-client	eq	0.1.0.dev0
openapi-python-client	eq	0.5.2
openapi-python-client	eq	0.1.2
openapi-python-client	eq	0.2.0
openapi-python-client	eq	0.4.0
openapi-python-client	eq	0.4.2
openapi-python-client	eq	0.5.1
openapi-python-client	eq	0.4.0rc1
openapi-python-client	eq	0.1.0
openapi-python-client	eq	0.2.1