Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63471— fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

Quick assessment

Affected
koxudaxi fastapi-code-generator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fastapi-code-generator 可根据 OpenAPI 文件生成 FastAPI 应用。在 0.8.1 版本之前，该工具会将 OpenAPI 路径作为带单引号的生成路由字符串插入到生成的 路由装饰器中，且未对嵌入的引号进行转义。若攻击者控制或影响 OpenAPI 路径，即可闭合该字符串，并向装饰器参数中注入有效的 Python 表达式。语法破坏型输入仅会导致生成失败，但语法正确的生成代码会在导入生成模块并求值装饰器时，以应用或 CI 进程的权限执行。此 OpenAPI 路径注入点与该项目中独立的操作摘

CVSS 9.3 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
koxudaxi fastapi-code-generator < 0.8.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63471

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
Source: CVE Program / CVE List V5
Vulnerability Description
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
koxudaxi fastapi-code-generator < 0.8.1 -

II. Public POCs for CVE-2026-63471

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63471

请登录查看更多情报信息。

Other References for CVE-2026-63471 (4)

Same Patch Batch · koxudaxi · 2026-11-03 · 3 CVEs total

CVE-2026-63469 9.3 CRITICAL fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get
CVE-2026-63470 9.3 CRITICAL fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler doc

IV. Related Vulnerabilities

Same product: fastapi-code-generator
Same vendor: koxudaxi
Same weakness: CWE-94