Security · High impactFan score 45 · Tier B
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470)
The Brief
- fastapi-code-generator writes an operation's summary into the generated route handler's docstring without escaping triple quotes.
- A """ in the summary closes the docstring and injects live code that runs at call time.
- The flaw is tracked as CVE-2026-63470 in the GitHub Advisory Database.
Why it matters
Developers who generate FastAPI route code from OpenAPI specs with this tool may run attacker-controlled code if a spec contains a crafted summary.
Who’s affected
- Teams using fastapi-code-generator to generate FastAPI code from OpenAPI specs
What to do
- Check the advisory for a fixed version before generating code from specs you do not fully trust
Affects fastapi-code-generator. Summary fastapi-code-generator (koxudaxi) emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live…
Timeline
Advisory published in the GitHub Advisory Database
GitHub Advisory Database
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470)