WhatBrokeToday
FAQ
Today's Trends
criticalInvestigatingPyPIv< 0.8.1

fastapi-code-generator Remote Code Execution Vulnerabilities in Versions Prior to 0.8.1

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

fastapi-code-generator is vulnerable to remote code execution (CVE-2026-63470 and CVE-2026-63469) via unescaped operation summaries in route-handler docstrings and unescaped response status-code keys in decorator responses. The issues affect versions prior to 0.8.1 and are fixed in version 0.8.1.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

fastapi-code-generator emits operation summaries into route handler docstrings without escaping triple quotes and response status-code keys into decorator dictionaries without escaping single quotes, allowing injected expressions to be evaluated at call time or import time.

Evidence

3 reports · 3 CVEShow
  1. [1]
    CVE First report
    fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring(opens security advisory in a new tab)

    Fixed in: fastapi-code-generator 0.8.1. Critical severity (CVE-2026-63470). Affected: fastapi-code-generator (pip) < 0.8.1. ### Summary fastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `"""`. A `"""` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED…

    by GitHub Advisory Database 0upvotes 0comments

  2. [2]
    CVE
    fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict(opens security advisory in a new tab)

    Fixed in: fastapi-code-generator 0.8.1. Critical severity (CVE-2026-63469). Affected: fastapi-code-generator (pip) < 0.8.1. ### Summary fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when…

    by GitHub Advisory Database 0upvotes 0comments96% match

  3. [3]
    CVE
    fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator(opens security advisory in a new tab)

    Fixed in: fastapi-code-generator 0.8.1. Critical severity (CVE-2026-63471). Affected: fastapi-code-generator (pip) < 0.8.1. ### Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (`@app.get('/u/<path>/x')`) without escaping the `'`. A `'` in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI…

    by GitHub Advisory Database 0upvotes 0comments98% match

Timeline

  1. First report on security advisory

    fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

    Source