CVE-2026-63469
Deferred Deferred - Pending Action

Code Injection in FastAPI Code Generator

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63469
EUVD
EUVD-2026-116146

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koxudaxi fastapi-code-generator < 0.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects fastapi-code-generator versions before 0.8.1. It allows attackers to inject malicious Python expressions into generated FastAPI code by manipulating OpenAPI response status-code keys. The tool fails to properly escape single quotes in these keys, enabling code injection when the generated module is imported and its decorator arguments are evaluated.

Detection Guidance

This vulnerability is specific to the fastapi-code-generator tool and cannot be directly detected on a network or system without inspecting the generated FastAPI code. Check if your system uses fastapi-code-generator versions prior to 0.8.1 by running: pip show fastapi-code-generator. If installed, verify the version matches or exceeds 0.8.1.

Impact Analysis

An attacker could execute arbitrary code on your system with the privileges of the application or CI process when the generated FastAPI code is imported. This could lead to data breaches, system compromise, or disruption of services. The attack requires only an attacker-controlled OpenAPI specification with multiple responses.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. This would violate compliance requirements for data protection and security in standards like GDPR and HIPAA, which mandate strict controls over data handling and system integrity.

Mitigation Strategies
  • Upgrade fastapi-code-generator to version 0.8.1 or later immediately using: pip install --upgrade fastapi-code-generator.
  • Review and regenerate any FastAPI applications created from OpenAPI files using older versions to ensure proper escaping of response status-code keys.
  • Audit generated code for suspicious expressions in decorator arguments, especially in responses={...} blocks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...