CVE-2026-63470: CVE-2026-63470: Call-Time Code Injection via Unescaped Route-Handler Docstrings in fastapi-code-generator

#security #cve #cybersecurity

CVE-2026-63470: Call-Time Code Injection via Unescaped Route-Handler Docstrings in fastapi-code-generator

Vulnerability ID: CVE-2026-63470
CVSS Score: 9.3
Published: 2026-11-09

CVE-2026-63470 (GHSA-h667-4jj2-cgv4) is a code injection vulnerability (CWE-94) in fastapi-code-generator prior to version 0.8.1. The tool generates FastAPI route handlers by directly interpolating the OpenAPI Operation.summary field into triple-double-quoted Python docstrings without escaping embedded triple quotes or backslashes. An attacker who supplies or modifies an OpenAPI specification can break out of the docstring literal and inject arbitrary Python expressions into the generated route handler body, resulting in remote code execution when the affected HTTP endpoint is called.

TL;DR

fastapi-code-generator versions prior to 0.8.1 fail to escape triple-double quotes when inserting OpenAPI Operation.summary strings into generated Python docstrings. Attackers controlling the input OpenAPI schema can inject arbitrary Python code that executes with the privileges of the FastAPI server process whenever the corresponding route handler is invoked.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-63470 (GHSA-h667-4jj2-cgv4)
Primary CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS v4.0 Score: 9.3 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
EPSS Score: 0.47% (40.75th Percentile)
Affected Component: fastapi-code-generator (< 0.8.1) - Operation.summary in fastapi_code_generator/parser.py
Trigger Mechanism: Call-time execution upon HTTP request to the generated FastAPI route handler
Exploit Status: PoC Available (Official test fixture in repository)
CISA KEV Status: Not Listed

Affected Systems

fastapi-code-generator (PyPI)
fastapi-code-generator: < 0.8.1 (Fixed in: 0.8.1)

Code Analysis

Commit: 49301db

Implement PythonEscapedString and sanitize Operation path, summary, additional_responses, and tags in parser.py.

Commit: b3b9bd6

Merge commit incorporating Python literal escaping fix into main branch.

Exploit Details

GitHub: Official regression test fixture (tests/data/openapi/coverage/python_literal_escaping.yaml) demonstrating docstring breakout and OS command execution via Operation.summary.

Mitigation Strategies

Upgrade fastapi-code-generator to version 0.8.1 or later across all developer workstations, build containers, and CI/CD pipelines.
Regenerate all previously generated FastAPI source code files that were produced from external, third-party, or untrusted OpenAPI specifications.
Enforce strict schema validation and manual code review on generated Python artifacts before deploying them to staging or production environments.
Ensure custom Jinja2 templates (--template-dir) strictly use triple-double quotes (""") for docstrings to align with the parser's escaping logic.

Remediation Steps:

Run pip install --upgrade "fastapi-code-generator>=0.8.1" (or update poetry/pipenv lockfiles) to install the patched release.
Audit existing generated FastAPI route files using grep -rnE '"""\s*\+' <generated_dir>/ to identify potential docstring breakout payloads.
Re-run fastapi-codegen against your OpenAPI schemas to replace unescaped route handlers with sanitized docstrings.
Inspect custom Jinja2 templates to verify that {{ operation.summary }} is only rendered inside """...""" blocks.

References

Read the full report for CVE-2026-63470 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community