CVE-2020-15142
Arbitrary Code Generation
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Arbitrary Code Generation
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
- Record
CVE-2020-15142- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2020-0122
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
- Record
EUVD-2020-0122- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9x4c-63pf-525f
openapi-python-client Arbitrary Code Generation vulnerability
Impact
Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .
Patches
Fix will be included in version 0.5.3
Workarounds
Inspect OpenAPI documents before generating, or inspect generated code before executing.
For more information
If you have any questions or comments about this advisory:
- Open an issue in openapi-python-client
- Email us at [email protected]
- Record
GHSA-9x4c-63pf-525f- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
- Record
CVE-2020-15142- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
- Record
CVE-2020-15142- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9x4c-63pf-525f
openapi-python-client Arbitrary Code Generation vulnerability
Impact
Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .
Patches
Fix will be included in version 0.5.3
Workarounds
Inspect OpenAPI documents before generating, or inspect generated code before executing.
For more information
If you have any questions or comments about this advisory:
- Open an issue in openapi-python-client
- Email us at [email protected]
- Record
GHSA-9x4c-63pf-525f- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2020-71 No score
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
- Record
PYSEC-2020-71- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openapi-python-clientPyPI |
before 0.5.3 | 0.5.3 |
openapi-python-clientPyPI |
before 0.5.3, plus listed versions 0.1.00.1.0.dev00.1.10.1.20.2.0 Show 9 moreShow less0.2.10.3.00.4.00.4.0rc10.4.10.4.20.5.00.5.10.5.2 |
0.5.3 |
openapi-python-clientPyPI |
before 0.5.3, plus listed versions 0.1.0.dev00.1.00.1.10.1.20.2.0 Show 9 moreShow less0.2.10.3.00.4.0rc10.4.00.4.10.4.20.5.00.5.10.5.2 |
0.5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15142 is a high vulnerability (CVSS 8.0) in Openapi-python-client Project Openapi-python-client, published August 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in openapi-python-client 0.5.3.
References
github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f
pypi.org/project/openapi-python-client
nvd.nist.gov/vuln/detail/CVE-2020-15142