CVE-2026-63471Critical· 9.3▾ Midnightfastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embed…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
fastapi-code-generator < 0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63470Critical· 9.3fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
CVE-2026-63469Critical· 9.3fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
CVE-2026-25755High· 8.1jsPDF is a library to generate PDFs in JavaScript
CVE-2026-63346High· 8.6Refitter: C# source injection through OpenAPI header parameter names
CVE-2026-63344High· 8.6Refitter: C# source injection through OpenAPI content-type map keys
CVE-2026-44266Critical· 9.8Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels