GCVE - cpe:2.3:a:openapi-generator:openapi

Approved changes feed: RSS · Atom

cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Openapi Generator (`b191470b-5bde-5aad-a97a-27dc8ab46573`)
Product	Openapi Generator (`92a6d201-2761-5fd7-be62-bea6b6c0cb0e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/openapitools/openapi-generator`	purl2cpe	2026-06-01 10:15:22.283348
`pkg:github/openapitools/openapi-generator`	purl2cpe	2026-06-01 10:15:22.283351
`pkg:maven/org.openapitools/openapi-generator-project`	purl2cpe	2026-06-01 10:15:22.283354

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-27162`	vulnerable	2026-06-08 05:57:40.689429	Details available openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. Published: 2023-03-31T00:00:00.000Z Updated: 2026-07-09T00:24:31.655Z Open on db.gcve.eu Reference links https://github.com/OpenAPITools/openapi-generator https://notes.sjtu.edu.cn/s/2_yki_2Xq https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21430`	vulnerable	2026-06-08 05:29:12.007846	Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code MEDIUM (6.2) OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Published: 2021-05-10T19:25:12.000Z Updated: 2024-08-03T18:09:16.157Z Open on db.gcve.eu Reference links https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w https://github.com/OpenAPITools/openapi-generator/pull/8791 https://github.com/OpenAPITools/openapi-generator/pull/8787	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21429`	vulnerable	2026-06-08 05:29:12.007452	Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin MEDIUM (4) OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. OpenAPI Generator maven plug-in creates insecure temporary files during the process. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Published: 2021-04-27T20:00:18.000Z Updated: 2024-08-03T18:09:16.096Z Open on db.gcve.eu Reference links https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-77cc-98mv https://github.com/OpenAPITools/openapi-generator/pull/8795	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21428`	vulnerable	2026-06-08 05:29:12.006980	Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator CRITICAL (9.3) Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Published: 2021-05-10T18:50:12.000Z Updated: 2024-08-03T18:09:16.010Z Open on db.gcve.eu Reference links https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf https://github.com/OpenAPITools/openapi-generator/pull/8788	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-11405`	vulnerable	2026-06-08 05:12:37.130628	Details available HIGH (8.1) OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies. Published: 2019-04-21T16:07:22.000Z Updated: 2024-08-04T22:55:40.800Z Open on db.gcve.eu Reference links https://github.com/OpenAPITools/openapi-generator/issues/2253 https://github.com/OpenAPITools/openapi-generator/pull/2248 https://github.com/OpenAPITools/openapi-generator/pull/2697	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Openapi Generator

Notes

PURL mappings

Vulnerability references

Contribute