EUVD-2026-116147

fastapi-code-generator: Import-time RCE via route path - unescaped @app.get'...' decorator...

CVE-2026-63470

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the application generation process. The root cause is the failure to escape triple quotes within the Operation.summary field when generating a route-handler docstring. An attacker-control...

CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...

CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...

CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...

PT-2026-136356

Name of the Vulnerable Software and Affected Versions fastapi-code-generator versions prior to 0.8.1 Description The software generates FastAPI applications from OpenAPI files. A flaw exists where the generator inserts the Operation.summary into a generated route-handler docstring as a...

CVE-2026-63469: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

PT-2026-136357

Name of the Vulnerable Software and Affected Versions fastapi-code-generator versions prior to 0.8.1 Description The software generates FastAPI applications from OpenAPI files. A flaw exists where an OpenAPI path is inserted into a generated @app.get... route decorator as a single-quoted string...

Coldai Aono FastAPI code generator improper output handling vulnerability

A security vulnerability exists in Koudai Aono FastAPI code generator versions prior to 0.8.1. This vulnerability arises because the generator fails to escape quotes within OpenAPI paths, inserting them into the @app.get route decorator string. As a result, attackers can inject Python expressions...

CVE-2026-63471: koxudaxi fastapi-code-generator: fastapi-code-generator creates FastAPI applications from OpenAPI files

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get... route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced...

Astra Linux - vulnerability in pillow

In Pillow versions prior to 9.0.0, PIL.ImageMath.eval enables evaluation of arbitrary expressions—including those that utilize the Python exec method. A lambda expression can also be used...

CVE-2026-108376

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.getfielddefault inserts a schema-controlled referenced record name into the callable...

CVE-2026-55244

ASTEVAL (a Python expression evaluator) prior to 1.0.9 has a sandbox escape via BaseException subclasses . The FROM_PY symbol table in astutils.py exposes SystemExit, KeyboardInterrupt, GeneratorExit, and BaseException to sandboxed expressions, while run() and eval() in asteval.py only catch Exce...

CVE-2026-54653

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled defaultfactory values in...

CVE-2026-54653: Improper Control of Generation of Code

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled defaultfactory values in...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

PT-2026-60137

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description The software fails to safely encode deployment configuration values during the generation of Python source code for API servers. This allows attackers to inject arbitrary Python expressions via th...

PT-2026-108670

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-79fv-7hq9-w7xg. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for...

SimpleEval security vulnerability

SimpleEval is a Python expression security evaluation library developed by Daniel. Versions of SimpleEval prior to 1.0.5 contained security vulnerabilities. These vulnerabilities stemmed from the possibility of objects directly accessing dangerous modules within the sandbox through attributes. If...