CVE-2026-63469 in fastapi-code-generator
Summary
by MITRE • 11/03/2026
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The fastapi-code-generator utility serves as a critical tool for developers seeking to automate the creation of FastAPI applications by translating OpenAPI specification files into executable Python code. While this automation significantly accelerates development workflows, it introduces specific security risks when the input specifications are not fully trusted or validated prior to processing. A significant vulnerability was identified in versions prior to 0.8.1, where the generator failed to properly sanitize user-controlled data within OpenAPI definitions before embedding them into generated Python source code. This flaw specifically affects how response status codes and associated metadata are handled during the generation process, leading to a potential Code Injection vulnerability that can be exploited if an attacker controls or influences parts of the input specification file.
The technical root cause lies in the string interpolation logic used by the generator when constructing route-decorator dictionaries. When processing multi-response OpenAPI operations, the tool inserts additional response status-code keys into the generated responses dictionary structure. In vulnerable versions, these keys are inserted as single-quoted Python strings without proper escaping of embedded quotes or other special characters that hold syntactic significance in Python. If an attacker provides a maliciously crafted second non-primary response key containing unescaped quotation marks or parentheses, they can effectively close the intended string literal and inject arbitrary Python expressions directly into the generated code structure. This is distinct from other known sinks such as route-path injection or operation-summary issues, representing a unique attack vector within the generator's architecture that targets the structural integrity of the dictionary literals used in FastAPI decorators.
The operational impact of this vulnerability extends beyond simple generation failures. While syntactically broken input merely causes the code generation process to fail and halt, providing no immediate execution risk, syntactically valid injected expressions pose a severe threat. When the generated module is subsequently imported by an application or processed within a Continuous Integration pipeline, Python evaluates the decorator arguments as part of its standard initialization routine. Consequently, any maliciously injected expression executes with the privileges of the user running the generator or the CI process. This can lead to remote code execution, allowing attackers to compromise the host system, exfiltrate sensitive data, or establish persistence mechanisms within the development environment. The severity is amplified by the fact that this occurs during a trusted build step where security controls are often relaxed for convenience and speed.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving unsanitized input in code generation tools, and maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, such as T1059 which covers various scripting languages including Python. The exploitation relies on the attacker's ability to influence the OpenAPI specification file used by the generator, highlighting the importance of treating all input specifications with the same rigor applied to direct user inputs in web applications. Mitigation strategies primarily involve upgrading to version 0.8.1 or later, where this specific injection vector has been patched through improved escaping mechanisms and stricter validation of generated string literals. Additionally, organizations should implement strict validation policies for OpenAPI files within their CI/CD pipelines, ensuring that only trusted sources are used as inputs for code generation tools to prevent the introduction of malicious payloads into the development workflow.