{"id":"CVE-2026-105801","aliases":["GHSA-5293-mq8x-g3xj","PYSEC-2026-4245"],"url":"https://o3.security/vulnerability/CVE-2026-105801","summary":"openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation","details":"### Impact\nA malicious OpenAPI document processed by any `openapi-python-client` prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute.\n\n### Patches\nVersions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents.\n\n### Workarounds\nDo not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.","published":"2026-10-06T14:53:42.461Z","modified":"2026-10-21T02:54:34.348439495Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"openapi-python-client","fixedVersion":"0.29.1"}],"fix":{"url":"https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186","label":"openapi-generators/openapi-python-client@1c99af4"},"references":[{"type":"WEB","url":"https://github.com/openapi-generators/openapi-python-client/releases/tag/v0.29.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105801.json"},{"type":"ADVISORY","url":"https://github.com/openapi-generators/openapi-python-client/security/advisories/GHSA-5293-mq8x-g3xj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105801"},{"type":"FIX","url":"https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186"},{"type":"FIX","url":"https://github.com/openapi-generators/openapi-python-client/pull/1483"},{"type":"PACKAGE","url":"https://github.com/openapi-generators/openapi-python-client"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:34.348439495Z"}}