CVE-2026-105801: openapi-python-client Arbitrary Code Generation from Malicious OpenAPI Documents
Summary
CVE-2026-105801: openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation. Affects openapi-python-client versions < 0.29.1. Fixed in 0.29.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openapi-python-client is a Python package that facilitates the generation of HTTP clients based on OpenAPI specifications. It streamlines the process of creating client libraries for APIs, allowing developers to interact with web services more efficiently. However, this package is vulnerable to exploitation when processing untrusted OpenAPI documents, which can lead to the generation of arbitrary and potentially harmful Python code.
Vulnerability Detail
The vulnerability arises from the ability of openapi-python-client versions prior to 0.29.1 to process malicious OpenAPI documents. When such a document is imported, it can generate arbitrary Python code that executes upon import. This poses a significant security risk, as it allows attackers to execute harmful code on the user's machine, potentially leading to data breaches or system compromise.
How To Fix
Minimum fixed version
0.29.1
This is the first release that contains the fix.
pip install --upgrade "openapi-python-client==0.29.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid generating clients from OpenAPI documents that you do not fully trust. Additionally, carefully audit any existing code generated from untrusted documents to ensure it does not contain malicious code.
Conclusion
The openapi-python-client package has a critical vulnerability that allows for arbitrary code generation from malicious OpenAPI documents. It is crucial for users to upgrade to version 0.29.1 or later to mitigate this risk. Additionally, users should exercise caution when dealing with untrusted documents and audit existing code.
See every vulnerability recorded for openapi-python-client →
FAQ
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
All versions of openapi-python-client prior to 0.29.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, ensure that you do not generate clients from untrusted OpenAPI documents and audit any existing generated code.
More information can be found in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/openapi-python-client/PYSEC-2026-4245.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for openapi-python-client.
