PYSEC-2020-70

2020-08-1417:15:00

Google

osv.dev

0.001 Low

EPSS

Percentile

31.7%

JSON

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

CPENameOperatorVersion
openapi-python-clienteq0.1.0.dev0
openapi-python-clienteq0.5.2
openapi-python-clienteq0.1.2
openapi-python-clienteq0.2.0
openapi-python-clienteq0.4.0
openapi-python-clienteq0.4.2
openapi-python-clienteq0.5.1
openapi-python-clienteq0.4.0rc1
openapi-python-clienteq0.1.0
openapi-python-clienteq0.2.1

Name	Operator	Version
openapi-python-client	eq	0.1.0.dev0
openapi-python-client	eq	0.5.2
openapi-python-client	eq	0.1.2
openapi-python-client	eq	0.2.0
openapi-python-client	eq	0.4.0
openapi-python-client	eq	0.4.2
openapi-python-client	eq	0.5.1
openapi-python-client	eq	0.4.0rc1
openapi-python-client	eq	0.1.0
openapi-python-client	eq	0.2.1