CVE-2026-63470: fastapi-code-generator code injection in docstring generation

CVE-2026-63470 · Severity: critical · CVSS 4 · Published 2026-11-03

fastapi-code-generator is a tool that automatically creates FastAPI web application code from OpenAPI specifications. If an attacker controls or influences the operation summary field in an OpenAPI file, they can inject malicious Python code that executes on the server when a route handler is called. This could allow unauthorized code execution with the privileges of the web server process.

Technologies: Koxudaxi Fastapi-Code-Generator, fastapi-code-generator (PyPI). Vendors: Koxudaxi, PyPI.

Quick answers

Is CVE-2026-63470 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63470 being exploited in the wild.
How severe is CVE-2026-63470?
Critical severity, with a CVSS score of 4, published 3 November 2026.
Which products and versions are affected?
Koxudaxi Fastapi-Code-Generator prior to 0.8.1; fastapi-code-generator (PyPI) < 0.8.1, ECOSYSTEM:introduced=0,fixed=0.8.1.
Is there a fix for CVE-2026-63470?
Yes. fastapi-code-generator (PyPI): upgrade to 0.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63470 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63470?
Check whether you run Koxudaxi Fastapi-Code-Generator or fastapi-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastapi-code-generator (PyPI): upgrade to 0.8.1 or later
    pip install "fastapi-code-generator>=0.8.1"

Technical details

The generator inserts the Operation.summary field from OpenAPI files into generated route-handler docstrings as a triple-quoted string without escaping embedded triple quotes. An attacker-controlled operation summary can close the docstring and inject a valid Python statement into the handler body. The injected code executes at call-time when the affected route handler is invoked, provided the syntax is valid. This is fixed in version 0.8.1 through proper escaping of Python literals.

Affected products

  • koxudaxi fastapi-code-generator prior to 0.8.1

Identifiers

  • CVE-2026-63470
  • GHSA-h667-4jj2-cgv4

Timeline

  • 2026-07-01: patched
  • 2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.