openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

ImpactA malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. PatchesVersions starting with 0.29.1 have updated with guardrails to prevent arbitrary...

aas2openapi (>=0.2.0, <=0.2.4), agentics-py (>=0.0.7, <=0.3.6) +11 more potentially affected by CVE-2026-105801 via openapi-python-client (>=0.14.1, <=0.29.0)

openapi-python-client PYPI version =0.14.1, =0.2.0, =0.0.7, =1.0.36, =25.12.0, =0.1.2, =1.5.0, =0.1.0, =0.25.2rc1, =0.2.0, =0.1.0, =2.0.0, =2.3.0 Source cves: CVE-2026-105801 Source advisory: OSV:PYSEC-2026-4245...

PYSEC-2026-4245 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Impact A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary...

CVE-2026-105801

A flaw was found in openapi-python-client. The generator fails to properly sanitize input from OpenAPI specification documents before rendering code strings and docstrings into generated Python files. An attacker could supply a specially crafted specification to inject arbitrary Python code,...

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Impact A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary...

GHSA-5293-MQ8X-G3XJ openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Impact A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary...

aas2openapi (>=0.2.0, <=0.2.4), agentics-py (>=0.0.7, <=0.3.6) +11 more potentially affected by CVE-2026-105801 via openapi-python-client (>=0.14.1, <=0.29.0)

openapi-python-client PYPI version =0.14.1, =0.2.0, =0.0.7, =1.0.36, =25.12.0, =0.1.2, =1.5.0, =0.1.0, =0.25.2rc1, =0.2.0, =0.1.0, =2.0.0, =2.3.0 Source cves: CVE-2026-105801 Source advisory: OSV:GHSA-5293-MQ8X-G3XJ...

aas2openapi (>=0.2.0, <=0.2.4), agentics-py (>=0.0.7, <=0.3.6) +11 more potentially affected by CVE-2026-105801 via openapi-python-client (>=0.14.1, <=0.29.0)

openapi-python-client PYPI version =0.14.1, =0.2.0, =0.0.7, =1.0.36, =25.12.0, =0.1.2, =1.5.0, =0.1.0, =0.25.2rc1, =0.2.0, =0.1.0, =2.0.0, =2.3.0 Source cves: CVE-2026-105801 Source advisory: GHSA-5293-MQ8X-G3XJ...

aas2openapi (>=0.2.0, <=0.2.4), agentics-py (>=0.0.7, <=0.3.6) +11 more potentially affected by CVE-2026-105801 via openapi-python-client (>=0.14.1, <=0.29.0)

openapi-python-client PYPI version =0.14.1, =0.2.0, =0.0.7, =1.0.36, =25.12.0, =0.1.2, =1.5.0, =0.1.0, =0.25.2rc1, =0.2.0, =0.1.0, =2.0.0, =2.3.0 Source cves: CVE-2026-105801 Source advisory: SNYK:PYTHON-OPENAPIPYTHONCLIENT-21692669...

Improper Neutralization

Overview openapi-python-client is a package that generates modern Python clients from OpenAPI. Affected versions of this package are vulnerable to Improper Neutralization via insufficient sanitization of OpenAPI document content when generating Python client code. An attacker who controls the...

CVE-2026-105801

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

EUVD-2026-93435

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801

The openapi-python-client library (prior to version 0.29.1 ) is vulnerable to arbitrary code generation because it fails to neutralize malicious content within OpenAPI documents before rendering string, docstring, and f-string contexts . An attacker providing a malicious OpenAPI document can caus...

aas2openapi (>=0.2.0, <=0.2.4), agentics-py (>=0.0.7, <=0.3.6) +11 more potentially affected by CVE-2026-105801 via openapi-python-client (>=0.14.1, <=0.29.0)

openapi-python-client PYPI version =0.14.1, =0.2.0, =0.0.7, =1.0.36, =25.12.0, =0.1.2, =1.5.0, =0.1.0, =0.25.2rc1, =0.2.0, =0.1.0, =2.0.0, =2.3.0 Source cves: CVE-2026-105801 Source advisory: MEND:CVE-2026-105801...

CVE-2026-105801 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

CVE-2026-105801: Improper Control of Generation of Code

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain...

PT-2026-106762

Name of the Vulnerable Software and Affected Versions openapi-python-client versions prior to 0.29.1 Description The generator fails to safely neutralize malicious content from OpenAPI documents before rendering string, docstring, and f-string contexts in the generated Python code. This allows an...