Live › vulnerability › CVE-2026-63470
fastapi-code-generator turns OpenAPI files into FastAPI applications and, before 0.8.1, pasted each operation's summary into a handler docstring without escaping embedded triple quotes. An attacker who controls or influences a summary can break out of the docstring and get injected Python that runs with the server's privileges when the route is called.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Teams that run fastapi-code-generator to produce FastAPI server code from OpenAPI files, especially where the OpenAPI document comes from outside the team or is edited by others. Generated code that is written once and reviewed by hand is less exposed than an automated pipeline that regenerates code from external specs. Teams that do not use the generator, or that only generate from specs they fully author, are less exposed.
No product ranges from the sources yet.
pip show fastapi-code-generator or pip freeze | grep fastapi-code-generator.0.8.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63470")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.