CVE-2026-63470
CriticalCVSS 9.3Summary
Prior to 0.8.1, fastapi-code-generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntactically valid generated code executes with the server process's privileges when the affected route handler is called.
Risk Assessment
Code injection into the route handler could lead to arbitrary code execution in the application server process, risking compromise of the service and its data.
Recommendation
Upgrade fastapi-code-generator to version 0.8.1 or later. Validate OpenAPI files from untrusted sources before generating code.
Other vulnerabilities in fastapi-code-generator
See all- CVE-2026-63471Critical
Prior to 0.8.1, fastapi-code-generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted string without escaping embedded quotes. An attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.
- CVE-2026-63469Critical
Prior to 0.8.1, fastapi-code-generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. An attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.
Original NVD description (English source)
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS