CVE-2026-105801

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105801

EUVD

EUVD-2026-93435

Affected Vendors & Products

Vendor	Product	Version / Range
openapi-generators	openapi-python-client	< 0.29.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The vulnerability in openapi-python-client before version 0.29.1 allows malicious OpenAPI documents to inject attacker-controlled Python code into generated Python clients. This code executes when a user imports the client, compromising the importing environment's integrity, confidentiality, and availability.

Detection Guidance

This vulnerability is specific to Python clients generated from OpenAPI documents using openapi-python-client versions before 0.29.1. Detection involves checking the version of openapi-python-client in use and inspecting generated Python clients for unsafe code execution risks.

Impact Analysis

If you use a vulnerable version of openapi-python-client, importing a generated client could execute malicious code on your system. This could lead to unauthorized access, data theft, or system compromise depending on the attacker's payload.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected clients may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade openapi-python-client to version 0.29.1 or later. Review and regenerate all Python clients from OpenAPI documents using the updated version to ensure malicious content is neutralized.

Hi! I’m here to help you understand CVE-2026-105801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70