fastapi-code-generator: import-time RCE via unescaped OpenAPI path and response status-code keys in generated code (CVE-2026-63471, CVE-2026-63469)
Severity: critical · Patch status: patched · Since 2026-11-09 · CVE-2026-63469, CVE-2026-63471
Two critical advisories (CVE-2026-63471, CVE-2026-63469) describe import-time RCE in fastapi-code-generator 0.8.0 and earlier. The generator emits the OpenAPI route path into @app.get('...') and extra-response status-code keys into the responses={...} decorator dict as single-quoted string literals without escaping the quote character. A crafted spec containing a ' in these pure-data fields closes the string and, via valid-Python concatenation, injects a live expression that executes when the generated main.py is imported at ASGI server startup — no request needed. Any app or CI pipeline generating a FastAPI app from an attacker-controlled or influenced spec is affected. Other fields (description, tags, parameter defaults, models) are escaped and not exploitable. Fixed in 0.8.1, which escapes these fields via repr and validates status-code keys.
What to do
- Upgrade fastapi-code-generator to 0.8.1 or later and regenerate all generated FastAPI apps
- Audit any generated main.py for suspicious string concatenation or __import__ expressions in @app.get(...) decorators and responses={...} dicts
- Treat OpenAPI spec sources as untrusted input; restrict which specs can be fed into code generation in CI and build pipelines
- Rebuild/redeploy services whose generated code came from third-party or user-influenced specs, and check for indicators of execution at import time
Fixed versions
- fastapi-code-generator 0.8.1
Sources
All live incidents on Threat Watch
