CVE-2026-63470

The record

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.

Affected packages

Related vulnerabilities

• CVE-2026-115878 Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and… CWE-94
• CVE-2026-115731 Deserialization of untrusted data in the report-processing code of Puppet, as used by… CWE-94
• CVE-2026-63471 fastapi-code-generator creates FastAPI applications from OpenAPI files. CWE-94
• CVE-2026-63469 fastapi-code-generator creates FastAPI applications from OpenAPI files. CWE-94
• CVE-2026-44267 Elo is a purely functional expression language for no-code tools. CWE-94
• CVE-2026-44266 Elo is a purely functional expression language for no-code tools. CWE-94
• CVE-2026-44265 Elo is a purely functional expression language for no-code tools. CWE-94
• CVE-2026-121260 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. CWE-94