{"id":"CVE-2026-63470","aliases":["GHSA-h667-4jj2-cgv4"],"url":"https://o3.security/vulnerability/CVE-2026-63470","summary":"fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring","details":"### Summary\n\nfastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `\"\"\"`. A `\"\"\"` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\ndef get_thing() -> None:\n (\n \"\"\"\n x\"\"\"\n + (__import__(\"os\").system('…') or \"\")\n + \"\"\"y\n \"\"\"\n )\n pass\n```\n\nThe generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout (`\"\"\"+expr+\"\"\"`, kept valid with `(… or \"\")`) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).\n\nNot a duplicate: distinct product from OpenAPI Generator's python-fastapi; and distinct field/sink from the route path -> @app.get('…') decorator (import-time) in the same product -- this is the operation summary in the handler docstring (call-time).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and calls the route handler; the injected expression runs and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution on the server when the affected endpoint is invoked, in any app generated with fastapi-code-generator from an attacker-controlled or attacker-influenced spec.\n\n### Suggested fix\n\nEscape the summary for the docstring context (escape `\"\"\"`/backslashes via repr, or strip triple-quotes) before emitting it as the handler docstring; apply the same to any free-text field rendered into a docstring. [maintainer-report.txt](https://github.com/user-attachments/files/29534450/maintainer-report.txt) [make_spec.py](https://github.com/user-attachments/files/29534452/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29534453/reproduce.sh)","published":"2026-11-03T19:13:47.034Z","modified":"2026-11-05T03:31:25.676075603Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"fastapi-code-generator","fixedVersion":"0.8.1"}],"fix":{"url":"https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","label":"koxudaxi/fastapi-code-generator@49301db"},"references":[{"type":"WEB","url":"https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63470.json"},{"type":"ADVISORY","url":"https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63470"},{"type":"FIX","url":"https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc"},{"type":"FIX","url":"https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332"},{"type":"PACKAGE","url":"https://github.com/koxudaxi/fastapi-code-generator"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:31:25.676075603Z"}}