CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
CriticalCVSS 9.3
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi fastapi-code-generator(PyPI) | < 0.8.1 | 0.8.1 |
| pypi fastapi-code-generator(PyPI) | = 0.0.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.10 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.11 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.12 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.13 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.14 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.15 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.16 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.17 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.18 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.19 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.2 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.3 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.4 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.5 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.6 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.7 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.8 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.0.9 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.1.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.1.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.2 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi fastapi-code-generator(PyPI) | = 0.2.3 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.4 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.5 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.6 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.2.7 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.2 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.3 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.4 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.5 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.3.6 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.4.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.4.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.4.2 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.4.3 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.4.4 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.1 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.2 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.3 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.3rc0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.5.4 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.6.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.7.0 | No fix listed |
| pypi fastapi-code-generator(PyPI) | = 0.8.0 | No fix listed |
| koxudaxi fastapi-code-generator | = < 0.8.1 | No fix listed |
References
- https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4 exploit vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc patch
- https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332 patch
- github.com product
- https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1
- github.com