fastapi-code-generator CVE-2026-63470

Exploitation requires that a FastAPI application be generated by fastapi-code-generator (< 0.8.1) from an OpenAPI spec whose Operation.summary field is attacker-controlled or attacker-influenced, and that the generated application then be deployed and the affected route handler actually invoked (the injected expression runs at call time, not at generation time). The payload must be syntactically valid Python that survives the generator's black/isort post-processing - the advisory's technique is '"""+expr+"""' kept valid via '(expr or "")'; a syntax-breaking summary only aborts generation and does not produce a vulnerable artifact. Limiting factors: the attacker needs write influence over the summary data field of the consumed spec, an operator must run the generator and deploy the output, and only the summary-in-handler-docstring path is affected (info.description, tags, parameter defaults are escaped, and models from datamodel-code-generator are repr-escaped). Risk is therefore real only in workflows that generate code from untrusted specs.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) scores this 9.3 Critical and the vuln.today decision label is act_now, signaling it should be remediated immediately. However, the signals must be read against the mechanism: this is a code-generation (build-time) developer tool, and the injected Python only executes at call time inside an application that was GENERATED from an attacker-controlled or attacker-influenced OpenAPI spec and then deployed. The PR:N/UI:N framing implies trivial drive-by remote exploitation, but the real precondition is attacker influence over the operation 'summary' field of the spec consumed by the generator, plus an operator who runs the generator and deploys the resulting handler - so realistic exposure is concentrated in CI/codegen pipelines that build FastAPI apps from untrusted or third-party specs, not in arbitrary internet-facing hosts. No CISA KEV entry is present in the input and no EPSS score was provided, so there is no evidence of active or widespread exploitation; the urgency rests on the act_now label, the Critical rating, and the existence of a reporter PoC rather than on observed in-the-wild activity. Net: a genuine high-impact RCE worth prioritizing wherever specs are untrusted, but materially narrower in real-world reach than the raw 9.3 implies - treat the no-conditions reading of the CVSS as optimistic for the attacker.

An organization auto-generates a FastAPI service from a third-party or user-supplied OpenAPI document; an attacker sets an operation's summary to a triple-quote breakout such as '"""+(__import__("os").system(...) or "")+"""', which fastapi-code-generator writes unescaped into the route handler's docstring as a live expression statement. Once the generated app is deployed, the first request to that endpoint executes the injected code at call time with the server process's privileges. A reporter PoC (reproduce.sh/make_spec.py) demonstrating this was attached to the GHSA advisory and verified on 0.8.0.