{"id":"CVE-2026-63470","aliases":["EUVD-2026-116145","GHSA-h667-4jj2-cgv4"],"status":"published","title":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00468,"percentile":0.40972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-94"],"published":"2026-11-03T19:13:47.034Z","modified":"2026-11-09T19:15:11Z","fixes":[{"ecosystem":"PyPI","package":"fastapi-code-generator","fixed_in":["0.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fastapi-code-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fastapi-code-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3rc0","0.5.4","0.6.0","0.7.0","0.8.0"]}],"products":[{"vendor":"koxudaxi","product":"fastapi-code-generator"}],"references":[{"url":"https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63470","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h667-4jj2-cgv4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63470.json","tags":["advisory"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63470","title":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T19:13:47.034Z","modified":"2026-11-03T19:34:47.499Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-03T21:03:49.178499Z"}],"euvd":[{"id":"EUVD-2026-116145","description":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","status":"published","published":"2026-11-09T18:50:00Z","modified":"2026-11-09T18:50:00Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-09T20:18:00.239313Z"}],"ghsa":[{"id":"GHSA-h667-4jj2-cgv4","title":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","description":"### Summary\n\nfastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `\"\"\"`. A `\"\"\"` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\ndef get_thing() -\u003e None:\n (\n \"\"\"\n x\"\"\"\n + (__import__(\"os\").system('…') or \"\")\n + \"\"\"y\n \"\"\"\n )\n pass\n```\n\nThe generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout (`\"\"\"+expr+\"\"\"`, kept valid with `(… or \"\")`) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).\n\nNot a duplicate: distinct product from OpenAPI Generator's python-fastapi; and distinct field/sink from the route path -\u003e @app.get('…') decorator (import-time) in the same product -- this is the operation summary in the handler docstring (call-time).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and calls the route handler; the injected expression runs and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution on the server when the affected endpoint is invoked, in any app generated with fastapi-code-generator from an attacker-controlled or attacker-influenced spec.\n\n### Suggested fix\n\nEscape the summary for the docstring context (escape `\"\"\"`/backslashes via repr, or strip triple-quotes) before emitting it as the handler docstring; apply the same to any free-text field rendered into a docstring. [maintainer-report.txt](https://github.com/user-attachments/files/29534450/maintainer-report.txt) [make_spec.py](https://github.com/user-attachments/files/29534452/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29534453/reproduce.sh)","status":"published","published":"2026-11-09T18:50:00Z","modified":"2026-11-09T18:50:01Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-09T19:19:25.977322Z"}],"nvd":[{"id":"CVE-2026-63470","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T20:18:15.59Z","modified":"2026-11-03T20:31:38.783Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-03T22:58:51.822037Z"}],"osv":[{"id":"CVE-2026-63470","title":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T19:13:47.034Z","modified":"2026-11-05T03:31:25.676075603Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"GHSA-h667-4jj2-cgv4","title":"fastapi-code-generator: Call-time RCE via operation summary -\u003e unescaped route-handler docstring","description":"### Summary\n\nfastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `\"\"\"`. A `\"\"\"` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\ndef get_thing() -\u003e None:\n (\n \"\"\"\n x\"\"\"\n + (__import__(\"os\").system('…') or \"\")\n + \"\"\"y\n \"\"\"\n )\n pass\n```\n\nThe generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout (`\"\"\"+expr+\"\"\"`, kept valid with `(… or \"\")`) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).\n\nNot a duplicate: distinct product from OpenAPI Generator's python-fastapi; and distinct field/sink from the route path -\u003e @app.get('…') decorator (import-time) in the same product -- this is the operation summary in the handler docstring (call-time).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and calls the route handler; the injected expression runs and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution on the server when the affected endpoint is invoked, in any app generated with fastapi-code-generator from an attacker-controlled or attacker-influenced spec.\n\n### Suggested fix\n\nEscape the summary for the docstring context (escape `\"\"\"`/backslashes via repr, or strip triple-quotes) before emitting it as the handler docstring; apply the same to any free-text field rendered into a docstring. [maintainer-report.txt](https://github.com/user-attachments/files/29534450/maintainer-report.txt) [make_spec.py](https://github.com/user-attachments/files/29534452/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29534453/reproduce.sh)","status":"published","published":"2026-11-09T18:50:00Z","modified":"2026-11-09T19:15:11.515980431Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-09T19:38:09.278998Z"}]}}