CVE-2020-15142: Arbitrary Code Generation in openapi-python-client
Summary
CVE-2020-15142: openapi-python-client Arbitrary Code Generation vulnerability. Affects openapi-python-client versions < 0.5.3. Fixed in 0.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openapi-python-client is a Python package available on PyPI that allows users to generate Python clients from OpenAPI documents. It provides a convenient way to interact with APIs defined using the OpenAPI Specification. However, a vulnerability has been discovered in versions prior to 0.5.3 that allows for arbitrary code generation. This means that if a maliciously crafted OpenAPI Document is used to generate a client, the resulting code can execute arbitrary Python code when executed. This vulnerability has a CVSS score of 8.0 (high).
Vulnerability Detail
The vulnerability in openapi-python-client arises from the improper handling of input during the code generation process. When a specially crafted OpenAPI Document is provided, the code generation process can be manipulated to generate code that executes arbitrary Python code. This can lead to unauthorized access, data leakage, or even remote code execution on the affected system. The vulnerability has been assigned the identifier CVE-2020-15142 and has a CVSS score of 8.0 (high).
How To Fix
Latest published version: 0.29.1 as of 23 Oct 2026
pip install --upgrade "openapi-python-client==0.29.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.3
This is the first release that contains the fix.
pip install --upgrade "openapi-python-client==0.5.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the fixed version is not immediately possible, users can inspect the OpenAPI documents before generating the client code. By carefully reviewing the document, any potential malicious code can be identified and removed. Additionally, generated code should be thoroughly inspected before execution to ensure it does not contain any unexpected or malicious code.
Conclusion
The vulnerability in openapi-python-client allows for arbitrary code generation when a maliciously crafted OpenAPI Document is used. This can lead to unauthorized access, data leakage, or remote code execution. It is recommended to update to version 0.5.3 or later of openapi-python-client to fix this vulnerability. If updating is not immediately possible, inspect the OpenAPI documents and generated code to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openapi-python-client →
FAQ
openapi-python-client is a Python package that allows for the generation of Python clients from OpenAPI documents. It simplifies the process of interacting with APIs defined using the OpenAPI Specification.
The impact of this vulnerability is that a maliciously crafted OpenAPI Document can lead to the generation of code that executes arbitrary Python code. This can result in unauthorized access, data leakage, or remote code execution on the affected system.
This vulnerability has a CVSS score of 8.0 (high).
To fix this vulnerability, update to version 0.5.3 or later of openapi-python-client. Run the command 'pip install --upgrade openapi-python-client==0.5.3' to update the package.
If updating to the fixed version is not immediately possible, inspect the OpenAPI documents before generating the client code to identify and remove any potential malicious code. Additionally, thoroughly inspect the generated code before execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for openapi-python-client.
