# fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-h667-4jj2-cgv4) · 2026-11-09 · Security
Page: https://themorning.dev/story/fastapi-code-generator-call-time-rce-via-operation-summary-unescaped-route-handl-d984152a674be083
Kind: security · Impact: high

## In brief

- fastapi-code-generator writes an operation's summary into the generated route handler's docstring without escaping triple quotes.
- A """ in the summary closes the docstring and injects live code that runs at call time.
- The flaw is tracked as CVE-2026-63470 in the GitHub Advisory Database.

## Why it matters

Developers who generate FastAPI route code from OpenAPI specs with this tool may run attacker-controlled code if a spec contains a crafted summary.

## What to do

- Check the advisory for a fixed version before generating code from specs you do not fully trust

## CVEs

- CVE-2026-63470

## Timeline

- 2026-11-09: Advisory published in the GitHub Advisory Database

## Coverage

- [fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring (CVE-2026-63470)](https://github.com/advisories/GHSA-h667-4jj2-cgv4) — GitHub Advisory Database, 2026-11-09

Tags: security, fastapi, code-generation, rce, python, openapi

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev