fastapi-code-generator vulnerabilities

Prior to 0.8.1, fastapi-code-generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted string without escaping embedded quotes. An attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.

Prior to 0.8.1, fastapi-code-generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntactically valid generated code executes with the server process's privileges when the affected route handler is called.

Prior to 0.8.1, fastapi-code-generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. An attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.