fastapi-code-generator EUVD-2026-116147

Not a flaw reachable by hitting the running application - exploitation requires the full generation-and-import path: (1) fastapi-code-generator version < 0.8.1; (2) an attacker-controlled or attacker-influenced OpenAPI spec whose path field contains a single quote (the unescaped @app.get('...') sink, distinct from the operation-summary docstring and additional-response-key sinks); (3) the injected payload must be syntactically valid Python (a '+expr+' concatenation kept valid with '(… or "")'), because the generator post-processes with black/isort and a syntax-breaking path only aborts generation as a DoS; and (4) the generated main.py must actually be imported (ASGI server startup or a CI import step) so the decorator argument is evaluated. Limiting factors: if all specs are trusted/first-party there is no attacker input; purely syntax-breaking input yields only generation failure, not RCE; and the generated module must be imported for code to run. Models produced via datamodel-code-generator are repr-escaped and not a sink.

All severity signals point the same direction except exploitation telemetry, which is absent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) scores 9.3 Critical and reflects unauthenticated, low-complexity code execution with full confidentiality, integrity and availability loss on the vulnerable system (no scope change to downstream systems). The vuln.today Decision label is act_now and CWE-94 (code injection) is corroborated by the GHSA advisory and the fix commit, so the technical impact is genuine rather than a high-CVSS-but-low-risk inflation. However, the network vector is conditional on data flow, not on a listening service: there is NO attacker request to the running app - exploitation requires that an attacker-controlled or attacker-influenced OpenAPI spec is processed by fastapi-code-generator < 0.8.1 and the generated module is then imported. This is effectively a build/CI-time supply-chain sink, which tempers the 'network unauthenticated' framing even though the metrics are defensible for an automated CI pipeline that fetches untrusted specs. No EPSS score and no KEV status are provided in the input, so real-world exploitation probability cannot be quantified and there is no confirmation of active exploitation; the GHSA advisory ships a reproduction script (reproduce.sh/make_spec.py, verified on 0.8.0), so working trigger mechanics are publicly documented. Net: treat as a real, actionable priority for anyone who code-generates FastAPI apps from untrusted or third-party OpenAPI specs; lower urgency for teams that only generate from trusted first-party specs.

An attacker supplies or influences an OpenAPI document (e.g., a third-party or vendor-provided spec pulled into a CI pipeline) whose path contains a single quote that closes the generated @app.get('...') string and concatenates a live Python expression such as (__import__("os").system('...') or ""). When fastapi-code-generator < 0.8.1 emits main.py and the ASGI server or CI imports that module, the decorator argument is evaluated and the injected code runs at import/startup with the process's privileges - no HTTP request to the app is needed. A public proof-of-concept (reproduce.sh + make_spec.py) is attached to the GHSA advisory and was verified on version 0.8.0.