Fastapi Code Generator
Monthly
Import-time code execution in fastapi-code-generator prior to 0.8.1: the tool writes an OpenAPI path verbatim into a single-quoted @app.get('...') route decorator, so a path containing a single quote closes the string literal and lets an attacker splice a live Python expression into the decorator argument. The payload is evaluated when the generated main.py is imported (for example when the ASGI server starts or a CI job imports the module), giving code execution with the generating application's or pipeline's privileges without the running service ever being remotely reachable. Any workflow that generates a FastAPI app from an attacker-controlled or attacker-influenced spec is affected; a public proof-of-concept harness (reproduce.sh and make_spec.py attached to the advisory) was verified against 0.8.0, and the issue is fixed in 0.8.1.
Import-time code execution in fastapi-code-generator prior to 0.8.1 lets an attacker who controls or influences an OpenAPI specification place a crafted secondary response status-code key that is emitted verbatim into the generated route decorator's responses={...} dictionary; because the key is written as a single-quoted Python literal without escaping embedded quotes, a valid expression can be concatenated into the decorator argument and runs as soon as the generated module is imported or served by the ASGI server, requiring no HTTP request. Only multi-response operations are a sink, since the responses dictionary is emitted solely when a second non-primary response exists, and remote, unauthenticated conditions apply (CVSS:4.0 AV:N/AC:L/PR:N/UI:N, all impact metrics High). It is not in CISA KEV and no exploitation in the wild is reported; a proof-of-concept reproducer is attached to the GitHub advisory and was verified against version 0.8.0, and the priority decision label is act_now. Patch status: Vendor-released patch: 0.8.1.
Code generation in fastapi-code-generator before 0.8.1 writes an OpenAPI Operation.summary verbatim into the generated route handler's triple-double-quoted docstring without escaping embedded """, so a crafted summary can close the docstring and inject a Python expression statement into the handler body that executes with the server process's privileges when that endpoint is called. Only code generated from an attacker-controlled or attacker-influenced spec and subsequently deployed is exposed; a syntax-breaking payload merely aborts generation (black/isort post-processing), so the practical payload must be valid Python such as the advisory's '"""+expr+"""' form kept valid with '(expr or "")'. The vendor CVSS 4.0 vector scores 9.3 Critical, our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (UI:R reflecting that an operator must generate and deploy the code), and the vuln.today decision label is act_now; a public PoC reference exists (reproduce.sh attached to the GitHub advisory, verified against 0.8.0) and no CISA KEV entry applies.
Import-time code execution in fastapi-code-generator prior to 0.8.1: the tool writes an OpenAPI path verbatim into a single-quoted @app.get('...') route decorator, so a path containing a single quote closes the string literal and lets an attacker splice a live Python expression into the decorator argument. The payload is evaluated when the generated main.py is imported (for example when the ASGI server starts or a CI job imports the module), giving code execution with the generating application's or pipeline's privileges without the running service ever being remotely reachable. Any workflow that generates a FastAPI app from an attacker-controlled or attacker-influenced spec is affected; a public proof-of-concept harness (reproduce.sh and make_spec.py attached to the advisory) was verified against 0.8.0, and the issue is fixed in 0.8.1.
Import-time code execution in fastapi-code-generator prior to 0.8.1 lets an attacker who controls or influences an OpenAPI specification place a crafted secondary response status-code key that is emitted verbatim into the generated route decorator's responses={...} dictionary; because the key is written as a single-quoted Python literal without escaping embedded quotes, a valid expression can be concatenated into the decorator argument and runs as soon as the generated module is imported or served by the ASGI server, requiring no HTTP request. Only multi-response operations are a sink, since the responses dictionary is emitted solely when a second non-primary response exists, and remote, unauthenticated conditions apply (CVSS:4.0 AV:N/AC:L/PR:N/UI:N, all impact metrics High). It is not in CISA KEV and no exploitation in the wild is reported; a proof-of-concept reproducer is attached to the GitHub advisory and was verified against version 0.8.0, and the priority decision label is act_now. Patch status: Vendor-released patch: 0.8.1.
Code generation in fastapi-code-generator before 0.8.1 writes an OpenAPI Operation.summary verbatim into the generated route handler's triple-double-quoted docstring without escaping embedded """, so a crafted summary can close the docstring and inject a Python expression statement into the handler body that executes with the server process's privileges when that endpoint is called. Only code generated from an attacker-controlled or attacker-influenced spec and subsequently deployed is exposed; a syntax-breaking payload merely aborts generation (black/isort post-processing), so the practical payload must be valid Python such as the advisory's '"""+expr+"""' form kept valid with '(expr or "")'. The vendor CVSS 4.0 vector scores 9.3 Critical, our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (UI:R reflecting that an operator must generate and deploy the code), and the vuln.today decision label is act_now; a public PoC reference exists (reproduce.sh attached to the GitHub advisory, verified against 0.8.0) and no CISA KEV entry applies.