CVE-2026-32735

{
  "id": "CVE-2026-32735",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32735",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-19T15:46:01.849351Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Chrimle",
          "product": "io.github.chrimle:openapi-to-java-records-mustache-templates-parent",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.1.1, < 3.5.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-18T23:17:29.710",
  "references": [
    {
      "url": "https://github.com/Chrimle/openapi-to-java-records-mustache-templates/pull/534",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Chrimle/openapi-to-java-records-mustache-templates/pull/620",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Chrimle/openapi-to-java-records-mustache-templates/releases/tag/v3.5.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Chrimle/openapi-to-java-records-mustache-templates/security/advisories/GHSA-3hrg-hjvj-9v66",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project (`openapi-to-java-records-mustache-templates-parent`), which is used to centralize plugin configurations for multiple unit-test modules, uses `maven-dependency-plugin` to unpack arbitrary `.mustache` files from the `openapi-to-java-records-mustache-templates` artifact (of the same version). While this parent POM file is not intended for external use, it is published, and could be used by anyone, and does not follow the best security practices. The risk, is that if `openapi-to-java-records-mustache-templates` would be compromised, and malicious `.mustache` files were to be included in the resulting JAR/artifact, users would unpack these files automatically during a dependency update. This is addressed in the v3.5.1 release of `openapi-to-java-records-mustache-templates-parent`. It is strongly recommended NOT to use the parent POM for external use. The `openapi-to-java-records-mustache-templates` module is the center of this project, and surrounding modules and configurations are not intended for production-use. These only exist for testing purposes and maintainability."
    },
    {
      "lang": "es",
      "value": "openapi-to-java-records-mustache-templates permite a los usuarios generar Java Records a partir de especificaciones OpenAPI. A partir de la versión 5.1.1 y antes de la versión 5.5.1, el archivo POM padre de este proyecto ('openapi-to-java-records-mustache-templates-parent'), que se utiliza para centralizar las configuraciones de plugins para múltiples módulos de pruebas unitarias, utiliza 'maven-dependency-plugin' para desempaquetar archivos '.mustache' arbitrarios del artefacto 'openapi-to-java-records-mustache-templates' (de la misma versión). Aunque este archivo POM padre no está destinado para uso externo, está publicado y podría ser utilizado por cualquiera, y no sigue las mejores prácticas de seguridad. El riesgo, es que si 'openapi-to-java-records-mustache-templates' fuera comprometido, y se incluyeran archivos '.mustache' maliciosos en el JAR/artefacto resultante, los usuarios desempaquetarían estos archivos automáticamente durante una actualización de dependencia. Esto se aborda en la versión v3.5.1 de 'openapi-to-java-records-mustache-templates-parent'. Se recomienda encarecidamente NO utilizar el POM padre para uso externo. El módulo 'openapi-to-java-records-mustache-templates' es el centro de este proyecto, y los módulos y configuraciones circundantes no están destinados para uso en producción. Estos solo existen con fines de prueba y mantenibilidad."
    }
  ],
  "lastModified": "2026-06-17T10:36:17.717",
  "sourceIdentifier": "security-advisories@github.com"
}