Live › vulnerability › CVE-2026-63471
fastapi-code-generator turns OpenAPI files into FastAPI applications, but before 0.8.1 it pasted OpenAPI path strings into generated route decorators without escaping quotes. An attacker who controls or influences the OpenAPI file can inject Python that runs with the privileges of the app or CI process when the generated module is imported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Teams that run fastapi-code-generator to create FastAPI code from OpenAPI files, especially in CI pipelines or where the OpenAPI input comes from untrusted sources. Projects that only generate code from their own trusted specs and do not use versions before 0.8.1 are less exposed. The sources do not describe other sinks being fixed beyond the OpenAPI path issue; the separate docstring and response-key sinks are noted as distinct.
No product ranges from the sources yet.
pip show fastapi-code-generator or the version pinned in your requirements or lock file.@app.get( decorators whose path argument contains unexpected quotes or code.fastapi-code-generator 0.8.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63471")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.