fastapi-code-generator: RCE via unescaped operation summary in generated handler docstring (CVE-2026-63470)
Severity: high · Patch status: patched · Since 2026-07-01 · CVE-2026-63470
fastapi-code-generator, which turns an OpenAPI file into a FastAPI application, copies each operation's summary into the generated route handler's docstring without escaping triple double quotes. A summary containing three double quotes can close that docstring early and continue the handler's first statement with an arbitrary Python expression, which runs every time the route is called. The generator does not execute the injected code. Exposure requires that someone other than the app's developers can influence the spec the generator reads: a third-party or remotely fetched spec, a service that builds apps from uploaded specs, or a spec change that is regenerated and deployed unreviewed. A proof of concept is attached to the advisory; no in-the-wild exploitation is reported, the CVE is not in CISA KEV, and EPSS is 0.005. The fix is in 0.8.1 (released 2026-07-01), which escapes the summary for the docstring context. Apps generated with 0.8.0 or earlier should be regenerated with 0.8.1 and their handler docstrings checked for injected expressions.
What to do
- Upgrade fastapi-code-generator to 0.8.1 and regenerate all FastAPI apps from your specs
- Audit already-generated code for suspicious concatenated expressions in handler docstrings, especially where summaries came from third-party specs
- Restrict which parties can supply or influence OpenAPI specs used for code generation
- Add CI checks flagging """ sequences or __import__ calls in generated handler docstrings
Fixed versions
- fastapi-code-generator 0.8.1
Sources
All live incidents on Threat Watch
