{"id":"CVE-2026-63471","aliases":["EUVD-2026-116147","GHSA-p2mm-64f6-gmpp"],"status":"published","title":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00312,"percentile":0.24437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-94"],"published":"2026-11-03T19:18:44.111Z","modified":"2026-11-09T20:00:04Z","fixes":[{"ecosystem":"PyPI","package":"fastapi-code-generator","fixed_in":["0.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fastapi-code-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fastapi-code-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3rc0","0.5.4","0.6.0","0.7.0","0.8.0"]}],"products":[{"vendor":"koxudaxi","product":"fastapi-code-generator"}],"references":[{"url":"https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63471","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p2mm-64f6-gmpp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63471.json","tags":["advisory"]},{"url":"https://github.com/koxudaxi/fastapi-code-generator","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63471","title":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T19:18:44.111Z","modified":"2026-11-07T03:25:51.938Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-07T04:32:31.343254Z"}],"euvd":[{"id":"EUVD-2026-116147","description":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","status":"published","published":"2026-11-09T19:48:08Z","modified":"2026-11-09T19:48:08Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-09T21:18:10.039091Z"}],"ghsa":[{"id":"GHSA-p2mm-64f6-gmpp","title":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","description":"### Summary\n\nfastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (`@app.get('/u/\u003cpath\u003e/x')`) without escaping the `'`. A `'` in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\n@app.get('/u/'+(__import__(\"os\").system('…') or \"\")+'/x', response_model=None)\ndef get_thing() -\u003e None:\n pass\n```\n\nThe generator post-processes output with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat (`'+expr+'`, kept valid with `(… or \"\")`) is written and runs at import. info.description (`description='…'`), tags, and parameter defaults are `'`-escaped; the path in @app.get('…') is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).\n\nNot a duplicate: distinct product from OpenAPI Generator's python-fastapi backend (different codebase/template/decorator); and distinct from the operation-summary docstring sink in the same product.\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and merely imports main.py; the injected expression runs at decorator evaluation and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution at import/startup in any application/CI that generates a FastAPI app with fastapi-code-generator from an attacker-controlled or attacker-influenced spec and imports/serves it. Estimated Critical, e.g. `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`.\n\n### Suggested fix\n\nEscape the path for the Python string literal (escape ', \\, newlines via repr) before emitting @app.get('…'), and validate path characters.\n\n[maintainer-report.txt](https://github.com/user-attachments/files/29534357/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29534358/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29534359/reproduce.sh)","status":"published","published":"2026-11-09T19:48:08Z","modified":"2026-11-09T19:48:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-09T19:49:32.474537Z"}],"nvd":[{"id":"CVE-2026-63471","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T20:18:15.753Z","modified":"2026-11-07T04:17:32.41Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-07T07:04:25.467195Z"}],"osv":[{"id":"CVE-2026-63471","title":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","status":"published","published":"2026-11-03T19:18:44.111Z","modified":"2026-11-11T10:47:34.797484043Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-11T03:21:18.82478Z"},{"id":"GHSA-p2mm-64f6-gmpp","title":"fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get('...') decorator","description":"### Summary\n\nfastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (`@app.get('/u/\u003cpath\u003e/x')`) without escaping the `'`. A `'` in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\n@app.get('/u/'+(__import__(\"os\").system('…') or \"\")+'/x', response_model=None)\ndef get_thing() -\u003e None:\n pass\n```\n\nThe generator post-processes output with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat (`'+expr+'`, kept valid with `(… or \"\")`) is written and runs at import. info.description (`description='…'`), tags, and parameter defaults are `'`-escaped; the path in @app.get('…') is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).\n\nNot a duplicate: distinct product from OpenAPI Generator's python-fastapi backend (different codebase/template/decorator); and distinct from the operation-summary docstring sink in the same product.\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and merely imports main.py; the injected expression runs at decorator evaluation and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution at import/startup in any application/CI that generates a FastAPI app with fastapi-code-generator from an attacker-controlled or attacker-influenced spec and imports/serves it. Estimated Critical, e.g. `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`.\n\n### Suggested fix\n\nEscape the path for the Python string literal (escape ', \\, newlines via repr) before emitting @app.get('…'), and validate path characters.\n\n[maintainer-report.txt](https://github.com/user-attachments/files/29534357/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29534358/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29534359/reproduce.sh)","status":"published","published":"2026-11-09T19:48:08Z","modified":"2026-11-09T20:00:04.177106569Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-09T20:08:38.95245Z"}]}}