Vulnerability · critical · CVSS 9.3
fastapi-code-generator flaw allows call-time RCE via operation summary (CVE-2026-63470)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Projects generating FastAPI routes from OpenAPI specs with fastapi-code-generator
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Public exploit · Remote, no login · Full takeover
What to do
- Check the advisory for a fixed version before generating code from specs you do not fully trust
The Brief
- fastapi-code-generator writes an operation's summary into the generated route handler's docstring without escaping triple quotes.
- A """ in the summary closes the docstring and injects live code that runs at call time.
- The flaw is tracked as CVE-2026-63470 in the GitHub Advisory Database.
Why it matters
Developers who generate FastAPI route code from OpenAPI specs with this tool may run attacker-controlled code if a spec contains a crafted summary.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: a code generator for FastAPI, used by developers building APIs. |
| No | Core infrastructure | Judgment: a single code-generation tool, not core infrastructure like OpenSSH or Docker. |
| No | Popular tool | Judgment: a niche developer tool, not a widely used mainstream framework or platform. |
| No | Exploited in the wild | GitHub Advisory Database: describes the flaw only; no observed attacks reported. |
| Yes | Public exploit | CISA SSVCCISA rates exploitation of CVE-2026-63470 as proof of concept public |
| Yes | Remote, no login | CVSSCVE-2026-63470: CVSS 9.3 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-63470: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | GitHub Advisory Database: reports code execution only; no data theft or exposure mentioned. |
| No | Supply chain | GitHub Advisory Database: a normal code-injection bug in legitimate code, not malicious shipping. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: fastapi-code-generator fixed in 0.8.1 |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-63470 ↗CVSS 9.3 critical AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
- Exploited
- Proof of concept public (CISA)
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 41% of all CVEs
- Fix
- fastapi-code-generator (pip) fixed in 0.8.1
- Weakness
- CWE-94, CWE-116
Timeline
Advisory published in the GitHub Advisory Database
GitHub Advisory Database
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470)
Source
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470) ↗ GitHub Advisory Database · 1h ago
First seen · 1 source · Full story page · How tiers are decided