CVE-2026-63470
Deferred Deferred - Pending Action

Code Injection in FastAPI Code Generator

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63470
EUVD
EUVD-2026-116145

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koxudaxi fastapi-code-generator < 0.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in fastapi-code-generator (versions before 0.8.1) allows an attacker to inject malicious Python code into a generated FastAPI application. The issue occurs when the tool inserts an OpenAPI operation summary into a route handler's docstring without properly escaping triple quotes. An attacker can craft a summary containing triple quotes to prematurely close the docstring and inject executable Python code. This code runs with the server's privileges when the vulnerable endpoint is accessed.

Detection Guidance

To detect this vulnerability, inspect generated FastAPI code for improperly escaped docstrings in route handlers. Check if operation summaries in OpenAPI specs contain triple quotes or special characters that could break out of docstrings. Review code generation logs for syntax errors during FastAPI application build.

Impact Analysis

If you use a vulnerable version of fastapi-code-generator, an attacker could gain full control over your FastAPI server. They could execute arbitrary commands, steal sensitive data, modify system files, or disrupt services. The attack requires the attacker to provide a malicious OpenAPI specification file that you then use to generate your application.

Compliance Impact

This vulnerability could lead to severe compliance violations. Unauthorized code execution may result in data breaches, exposing personal data governed by GDPR or protected health information under HIPAA. Organizations could face regulatory fines, legal liabilities, and reputational damage due to compromised systems handling sensitive data.

Mitigation Strategies
  • Upgrade fastapi-code-generator to version 0.8.1 or later to apply the security fixes.
  • Review and sanitize all OpenAPI specifications used for code generation, especially operation summaries containing triple quotes or special characters.
  • Regenerate FastAPI applications from updated OpenAPI specs to ensure proper escaping in generated code.
  • Monitor generated code for unexpected code execution or syntax errors in route handlers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...