fastapi-code-generator vulnerabilities
CVEs whose affected-version data names the fastapi-code-generator package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-63470Critical· 9.3PoCfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple qu…
CVE-2026-63471Critical· 9.3fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embed…
CVE-2026-63469Critical· 9.3fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python …