CVE-2026-63471 Details
Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
A vulnerability in fastapi-code-generator prior to version 0.8.1 allows for injection of unescaped OpenAPI path strings into FastAPI route decorators. This flaw can be exploited by crafting an attacker-controlled OpenAPI path that, when processed by the code generator, closes the string and injects a valid Python expression. The injected code is executed with the application's privileges when the generated module is imported and the decorator is evaluated. The issue arises because the generator fails to properly escape single quotes in the path, creating a route string that can execute arbitrary commands via the os module. This vulnerability is distinct from similar issues in other OpenAPI generation tools and from other injection points within the same tool.
Users can upgrade to fastapi-code-generator version 0.8.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc | [email protected] | Source CodeVendor |
| https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332 | [email protected] | Source CodeVendor |
| https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1 | [email protected] | Release NotesVendor |
| https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi fastapi-code-generator | < 0.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |