CVE-2017-1000207

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10002088.8A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a malicious CVE-2017-10002095.9The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (C CVE-2017-10002109.8picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer overflow resulting in code execution or denial of service attack CVE-2017-10002115.3Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can a CVE-2017-10002129.8Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute r CVE-2017-10002134.8WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search CVE-2017-10002149.8GitPHP by xiphux is vulnerable to OS Command Injections CVE-2017-10002159.8ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution CVE-2017-10002178.8Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in CVE-2017-10002189.8LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code exec CVE-2017-10002199.8npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user CVE-2017-10002209.8soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution