Improper Neutralization of Special Elements in Output Used by a Downstream Component in openapi-python-client - #VU161876
Published: November 8, 2026
Vulnerability identifier: #VU161876
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-74
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated local attacker to set unauthorized multipart form fields in requests produced by clients generated with openapi-python-client.
The vulnerability exists due to a fixed, predictable multipart boundary in generated clients that accept untrusted input permitted to populate only some form fields. An unauthenticated local attacker can include the boundary in an allowed field's content to inject additional fields or override fields outside their permitted control.
Affected software
openapi-python-client
Remediation
Install security update from vendor's website.
openapi-python-client - update to 0.30.0