OpenAPI Generator is a widely used code-generation tool that translates OpenAPI specifications into client libraries, server stubs, and documentation across multiple programming languages and frameworks, creating a broad downstream impact despite a narrow direct product footprint. The vulnerability exposure associated with this vendor reflects the tool's role in the software supply chain: flaws in the generator itself can propagate to every downstream artifact it produces, affecting the security posture of generated applications across diverse deployments. Current CVE counts, severity profiles, and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openapi Generator over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-27162CRITICAL openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to | Mar 31, 2023 | 9.1 | 24 | NO | NO |
CVE-2019-11405HIGH OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecu | Apr 22, 2019 | 7.4 | 23 | NO | NO |
CVE-2021-21428HIGH Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec | May 10, 2021 | 7.0 | 22 | NO | NO |
CVE-2021-21430MEDIUM OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createT | May 10, 2021 | 5.5 | 19 | NO | NO |
OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK w | Apr 27, 2021 | 3.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openapi Generator.
Media articles that mention a CVE ID that affects a product developed by Openapi Generator — matched by CVE ID, not by vendor name.