- Severity: CRITICAL
- CVE: CVE-2026-63470
- Ecosystems: pip
- Packages: fastapi-code-generator
### Summary
fastapi-code-generator (koxudaxi) emits an operation’s `summary` as the generated route handler’s docstring, using a triple-quoted string without escaping `”””`. A `”””` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body — which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.
### Details
“`python
def get_thing() -> None:
(
“””
x”””
+ (__import__(“os”).system(‘…’) or “”)
+ “””y
“””
)
pass
“`
The generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout (`”””+expr+”””`, kept valid with `(… or “”)`) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).
Not a duplicate: distinct product from OpenAPI Generator’s python-fastapi; and distinct field/sink from the route path -> @app.get(‘…’) decorator (import-time) in the same product — this is the operation summary in the handler docstring (call-time).
### PoC
`reproduce.sh` (+ `make_spec.py`) attached: generates the app and calls the route handler; the injected expression runs and writes a marker. Verified on 0.8.0.
### Impa…
Source: GitHub Security Advisories · 2026-11-09