CVE-2026-32735

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project (`openapi-to-java-records-mustache-templates-parent`), which is used to centralize plugin configurations for multiple unit-test modules, uses `maven-dependency-plugin` to unpack arbitrary `.mustache` files from the `openapi-to-java-records-mustache-templates` artifact (of the same version). While this parent POM file is not intended for external use, it is published, and could be used by anyone, and does not follow the best security practices. The risk, is that if `openapi-to-java-records-mustache-templates` would be compromised, and malicious `.mustache` files were to be included in the resulting JAR/artifact, users would unpack these files automatically during a dependency update. This is addressed in the v3.5.1 release of `openapi-to-java-records-mustache-templates-parent`. It is strongly recommended NOT to use the parent POM for external use. The `openapi-to-java-records-mustache-templates` module is the center of this project, and surrounding modules and configurations are not intended for production-use. These only exist for testing purposes and maintainability.

• CWE-20

• https://github.com/Chrimle/openapi-to-java-records-mustache-templates/pull/534
• https://github.com/Chrimle/openapi-to-java-records-mustache-templates/pull/620
• https://github.com/Chrimle/openapi-to-java-records-mustache-templates/releases/tag/v3.5.1
• https://github.com/Chrimle/openapi-to-java-records-mustache-templates/security/advisories/GHSA-3hrg-hjvj-9v66

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3273A vulnerability was identified in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32730ApostropheCMS is an open-source content management framework…8.1
• CVE-2026-32731ApostropheCMS is an open-source content management framework…9.9
• CVE-2026-32732Lean 4 VS Code Extension is a Visual Studio Code extension f…0
• CVE-2026-32733Halloy is an IRC application written in Rust. Prior to commi…6.5
• CVE-2026-32734baserCMS is a website development framework. Prior to versio…6.1
• CVE-2026-32736The Hytale Modding Wiki is a free service for Hytale mods to…4.3
• CVE-2026-32737Romeo gives the capability to reach high code coverage of Go…10
• CVE-2026-32738libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32739libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-3274A security flaw has been discovered in Tenda F453 1.0.0.3. A…8.8
• CVE-2026-32740libheif is a HEIF and AVIF file format decoder and encoder. …8.8