Lucene search
+L

616 matches found

Github Security Blog
Github Security Blog
•added 2026/11/09 7:48 p.m.•2 views

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

Summary fastapi-code-generator koxudaxi emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal @app.get'/u//x' without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator...

9.3CVSS6AI score0.00312EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder