Description
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
triaxtec openapi-python-client
< 0.5.3affected
References
- https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f ↗
- https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a ↗
- https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13 ↗
- https://pypi.org/project/openapi-python-client/ ↗