SB2026110843 - Multiple vulnerabilities in openapi-python-client

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110843

SB2026110843 - Multiple vulnerabilities in openapi-python-client

Published: November 8, 2026

Security Bulletin ID SB2026110843
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated local attacker to set unauthorized multipart form fields in requests produced by clients generated with openapi-python-client.

The vulnerability exists due to a fixed, predictable multipart boundary in generated clients that accept untrusted input permitted to populate only some form fields. An unauthenticated local attacker can include the boundary in an allowed field's content to inject additional fields or override fields outside their permitted control.


Remediation

Install update from vendor's website.

References