fastapi-code-generator EUVD-2026-116146

Requires fastapi-code-generator prior to 0.8.1 processing an OpenAPI operation that defines MULTIPLE responses - the responses={...} decorator dict is only emitted when a second (non-primary) response exists, so single-response operations are not a sink. The attacker must control or influence that secondary response's status-code key, and the payload must be syntactically valid Python kept valid via concatenation (e.g. ('+expr+' with (... or "")); a syntax-breaking payload only aborts generation at the black/isort post-process step (DoS, not RCE). Execution occurs when the generated main.py is imported or served (ASGI startup imports it) in the victim or CI environment, with no HTTP request needed. Limiting factors: the attacker must be able to inject into the OpenAPI spec that the victim generates from, the operation must be multi-response, and the victim must actually run the generator and import/serve the output - related sinks (content-type key normalized to 'model', info.* repr-escaped, operationId fails closed) are not exploitable.

This is a genuine high-priority issue for the population that uses it, but its blast radius is narrow. The signals are mostly aligned: CVSS 4.0 base is 9.3 (Critical) with AV:N/AC:L/AT:N/PR:N/UI:N and full VC:H/VI:H/VA:H, CWE-94 code injection, and the vuln.today decision label is act_now - all pointing to a deterministic, high-impact code-execution flaw. A verified PoC (reproduce.sh/make_spec.py) is attached to the GHSA advisory and a fix exists (0.8.1), so there is no ambiguity about reality or mechanism. However, two risk-dampening facts must be stated explicitly: the input contains NO EPSS score and NO CISA KEV listing, so there is no evidence of active or widespread exploitation - this is not a confirmed in-the-wild threat, and real exposure depends entirely on whether a deployment feeds attacker-influenced OpenAPI specs into the generator. Also note a tension with the CVSS vector: it is scored AV:N/PR:N/UI:N as if remotely triggerable, but exploitation actually requires a victim or CI pipeline to run the code generator on the malicious spec and then import the generated module - the 'network, no interaction' rating reflects the data-injection framing (processing an attacker-supplied spec), not a direct unauthenticated network request. Net: treat as urgent patch for anyone generating FastAPI apps from untrusted/third-party OpenAPI specs in CI or at startup; lower practical urgency for teams that only generate from fully trusted, internally-authored specs.

An attacker who can influence an OpenAPI spec consumed by a victim's build/CI pipeline (e.g., a third-party or user-submitted API definition) adds a multi-response operation whose non-primary response status-code key embeds a valid Python expression such as '404' + (__import__("os").system('...') or "") + 'x'. When fastapi-code-generator (< 0.8.1) emits the responses={...} decorator dict, the unescaped single-quoted key injects the live expression, which executes the moment the generated main.py is imported - for example at ASGI server startup or during CI - requiring no HTTP request. A working PoC verified against 0.8.0 is attached to the advisory.