CVE-2026-63471
CriticalCVSS 9.3Summary
Prior to 0.8.1, fastapi-code-generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted string without escaping embedded quotes. An attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.
Risk Assessment
Code injection into the generated application could lead to arbitrary code execution in the application or CI environment, risking compromise of the build pipeline or production.
Recommendation
Upgrade fastapi-code-generator to version 0.8.1 or later. Do not generate code from untrusted OpenAPI files without prior validation.
Other vulnerabilities in fastapi-code-generator
See all- CVE-2026-63470Critical
Prior to 0.8.1, fastapi-code-generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntactically valid generated code executes with the server process's privileges when the affected route handler is called.
- CVE-2026-63469Critical
Prior to 0.8.1, fastapi-code-generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. An attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.
Original NVD description (English source)
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS