---
id: "CVE-2026-63471"
kind: "vulnerability"
aliases: ["CVE-2026-63471"]
title: "fastapi-code-generator: crafted OpenAPI path injects Python code into generated apps"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "code-generation", "fastapi", "package", "python"]
not_affected_if: ["trusted-specs-only", "version-0.8.1-or-later"]
published_at: "2026-11-03T20:18:15+00:00"
first_seen_at: "2026-11-03T20:49:23+00:00"
updated_at: "2026-11-03T20:49:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63471", "first_seen_at": "2026-11-03T20:49:23+00:00"}]
---

# fastapi-code-generator: crafted OpenAPI path injects Python code into generated apps

fastapi-code-generator turns OpenAPI files into FastAPI applications, but before 0.8.1 it pasted OpenAPI path strings into generated route decorators without escaping quotes. An attacker who controls or influences the OpenAPI file can inject Python that runs with the privileges of the app or CI process when the generated module is imported.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show fastapi-code-generator` or the version pinned in your requirements or lock file.
- Look for OpenAPI specs from outside parties, or specs fetched at build time, that feed the generator.
- Inspect generated modules for `@app.get(` decorators whose path argument contains unexpected quotes or code.

## Fix

- `fastapi-code-generator` `0.8.1`

## Timeline

- 2026-11-03T20:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63471

## Documents

- [advisory] Vendor advisory: github.com https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp
- [fix] Patch: github.com https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc
- [fix] Patch: github.com https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332
- [fix] Release notes: github.com https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1

## From the sources

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_