CVE-2026-63470 in fastapi-code-generator
Summary
by MITRE • 11/03/2026
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The fastapi-code-generator utility serves as a critical tool for developers seeking to automate the creation of FastAPI applications based on OpenAPI specifications. By parsing these specification files, the generator produces Python code that implements route handlers and associated logic. However, versions prior to 0.8.1 contain a significant input validation flaw related to how operation metadata is processed during code generation. Specifically, when generating docstrings for route handlers, the tool inserts the value of Operation.summary directly into the generated source code as a triple-double-quoted string without performing necessary escaping on embedded triple quotes. This lack of sanitization creates an opportunity for code injection if the input data originates from untrusted sources or is influenced by malicious actors who can control the OpenAPI specification content.
The technical nature of this vulnerability constitutes an Improper Input Validation issue, aligning with CWE-20 in common weakness enumerations. The core flaw lies in the failure to escape special characters within string literals before embedding them into executable code structures. When a user-supplied or attacker-controlled Operation.summary contains triple double quotes ("""), it prematurely terminates the intended docstring literal. This closure allows subsequent content in the summary field, if syntactically valid Python, to be interpreted as part of the handler body rather than as string data. Consequently, an attacker can inject arbitrary Python expression statements into the generated route handler function.
The operational impact of this vulnerability is severe due to its execution context. While malformed input that breaks syntax merely causes the code generation process to fail and prevents deployment, syntactically valid injected payloads are executed with the privileges of the server process when the affected endpoint is invoked by a client. This represents an Insecure Code Generation flaw (CWE-95) where untrusted data influences executable logic. The risk is distinct from other known sinks in this project because it occurs at call time within the handler body rather than during import-time processing of route paths or response keys. An attacker who can manipulate the OpenAPI specification used to generate server code could achieve remote code execution on the host system, potentially leading to full compromise of the application infrastructure and data confidentiality breaches.
Mitigation strategies primarily involve upgrading to version 0.8.1 or later, where this specific escaping mechanism has been corrected to properly handle embedded quotes within string literals. For environments unable to upgrade immediately, defensive coding practices should be adopted by ensuring that any OpenAPI specifications consumed by the generator are strictly validated and sanitized before processing. Input validation frameworks should enforce constraints on metadata fields like Operation.summary to prevent injection of special characters or code-like structures. Additionally, implementing strict content type verification for API definitions can reduce the attack surface associated with dynamic specification ingestion. Monitoring logs for unusual patterns in generated code artifacts may also aid in detecting attempted exploitation activities during development pipelines.