Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63470— fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Quick assessment

Affected
koxudaxi fastapi-code-generator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fastapi-code-generator 工具可根据 OpenAPI 文件生成 FastAPI 应用程序。在 0.8.1 版本之前，该生成器会将 Operation.summary 字段作为三双引号（"""）字符串插入到生成的路由处理器文档字符串中，但未对其中嵌入的三引号进行转义处理。若攻击者能够控制或影响操作摘要（operation summary），则可提前闭合文档字符串，从而向处理器函数体中注入有效的 Python 表达式语句。仅破坏语法的输入会导致代码生成失败；然而，若生成的代码语法正确，则在调用受影响

CVSS 9.3 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
koxudaxi fastapi-code-generator < 0.8.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63470

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
Source: CVE Program / CVE List V5
Vulnerability Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
koxudaxi fastapi-code-generator < 0.8.1 -

II. Public POCs for CVE-2026-63470

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63470

请登录查看更多情报信息。

Other References for CVE-2026-63470 (4)

Same Patch Batch · koxudaxi · 2026-11-03 · 3 CVEs total

CVE-2026-63469 9.3 CRITICAL fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get
CVE-2026-63471 9.3 CRITICAL fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decora

IV. Related Vulnerabilities

Same product: fastapi-code-generator
Same vendor: koxudaxi
Same weakness: CWE-94