Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. Patches Versions starting with 0.29.1 have updated with guardrails to prevent arbitrary code generation. Upgrade to this version immediately and audit any code previously generated from untrusted documents. Workarounds Do not generate clients for documents you don't completely trust. Carefully verify any existing generated code from untrusted documents.
Recommended action: Upgrade to 0.29.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C . Patches Fix will be included in version 0.5.3 Workarounds Inspect OpenAPI documents before generating, or inspect generated code before executing. For more information If you have any questions or comments about this advisory: Open an issue in openapi-python-client Email us at danthony@triaxtec.com
Recommended action: Upgrade to 0.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk. Giving this a CVSS score of 3.0 (Low) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:C Patches A fix is being worked on for version 0.5.3 Workarounds Inspect OpenAPI documents before generating clients for them. For more information If you have any questions or comments about this advisory: Open an issue in openapi-python-client Email us at danthony@triaxtec.com
Recommended action: Upgrade to 0.5.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.