Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63469— fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

Quick assessment

Affected
koxudaxi fastapi-code-generator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fastapi-code-generator 可根据 OpenAPI 文件生成 FastAPI 应用。在 0.8.1 版本之前，该工具会在生成的 路由装饰器字典中插入一个额外的响应状态码键，并以单引号 Python 字符串的形式存储，且未对其中嵌入的引号进行转义。若一个支持多响应的 OpenAPI 操作包含由攻击者控制或可被攻击者影响的第二个非主要响应键，攻击者即可闭合该字典键的字面量，并注入有效的 Python 表达式。语法破坏的输入仅会导致代码生成失败；而语法正确的生成代码在导入生成模块并求值其装饰器参数时，将

CVSS 9.3 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
koxudaxi fastapi-code-generator < 0.8.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63469

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
Source: CVE Program / CVE List V5
Vulnerability Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
koxudaxi fastapi-code-generator < 0.8.1 -

II. Public POCs for CVE-2026-63469

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63469

请登录查看更多情报信息。

Other References for CVE-2026-63469 (4)

Same Patch Batch · koxudaxi · 2026-11-03 · 3 CVEs total

CVE-2026-63471 9.3 CRITICAL fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decora
CVE-2026-63470 9.3 CRITICAL fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler doc

IV. Related Vulnerabilities

Same product: fastapi-code-generator
Same vendor: koxudaxi
Same weakness: CWE-94