https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:53:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-22200 EUVD-2026-22200 https://cve.radiocsirt.org/vuln/euvd-2026-22200 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21428 <p>Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.</p> <p>Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21428 https://cve.radiocsirt.org/vuln/ghsa-23x4-m842-fmwf <p><strong>Affected:</strong> Maven: org.openapitools:openapi-generator-online</p> <p>### Impact</p> <p>On Unix like systems, the system&#39;s temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory.</p> <p>This vulnerability is local privilege escalation because the contents of the outputFolder can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled.</p> <p>openapi-generator-online creates insecure temporary folders with `File.createTempFile` during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system.</p> <p>### Vulnerable Code</p> <p>https://github.com/OpenAPITools/openapi-generator/blob/c6530519975341d7784a252132b2f0854f488901/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java#L184-L187</p> <p>This vulnerability exists due to a race condition between the deletion of the randomly generated temporary file and the creation of the temporary directory.</p> <p>```java File outputFolder = File.createTempFile(&#34;codegen-&#34;, &#34;-tmp&#34;); // Attacker knows the full path of the file that will be generated // delete the file that was created outputFolder.delete(); // Attacker sees file is deleted and begins a race to create their own directory before the code generator // and make a directory of the same name // SECURITY VULNERAB…</p> <p><strong>Affected:</strong> Maven: org.openapitools:openapi-generator-online</p> <p>### Impact</p> <p>On Unix like systems, the system&#39;s temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory.</p> <p>This vulnerability is local privilege escalation because the contents of the outputFolder can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled.</p> <p>openapi-generator-online creates insecure temporary folders with `File.createTempFile` during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system.</p> <p>### Vulnerable Code</p> <p>https://github.com/OpenAPITools/openapi-generator/blob/c6530519975341d7784a252132b2f0854f488901/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java#L184-L187</p> <p>This vulnerability exists due to a race condition between the deletion of the randomly generated temporary file and the creation of the temporary directory.</p> <p>```java File outputFolder = File.createTempFile(&#34;codegen-&#34;, &#34;-tmp&#34;); // Attacker knows the full path of the file that will be generated // delete the file that was created outputFolder.delete(); // Attacker sees file is deleted and begins a race to create their own directory before the code generator // and make a directory of the same name // SECURITY VULNERAB…</p> https://cve.radiocsirt.org/vuln/ghsa-23x4-m842-fmwf https://cve.radiocsirt.org/vuln/gsd-2021-21428 gsd-2021-21428 https://cve.radiocsirt.org/vuln/gsd-2021-21428