CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get... route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced...

CVE-2026-63471

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the import time of a generated module. The root cause is the failure to escape embedded quotes when inserting an OpenAPI path into a generated @app.get(...) route decorator. An attacker w...

CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get... route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced...

CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

CVE-2026-63469

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the application generation process. The root cause is a code injection vulnerability where the generator inserts a response status-code key into a generated responses={...} route-decorato...

Malicious code in @corexium/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729 package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest'...

MAL-2026-18491 Malicious code in @corexium/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729 package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest'...

MAL-2026-18249 Malicious code in noelc-css-blender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1af88de104874d73dc5e8853fec7d4ca8b0c2c1dfa26a3cff9e44fac7eb30ea6 [email protected] declares itself as a 'tiny ESM utility for blending CSS custom-property token maps' with zero dependencies, but ships two...

PYSEC-2026-4210 Docling imports plugin entry points before the allow_external_plugins check

Summary allowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards...

Docling imports plugin entry points before the allow_external_plugins check

Summaryallowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards do...

GHSA-9JXX-VJRV-H2RQ Docling imports plugin entry points before the allow_external_plugins check

Summary allowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards...

Docling imports plugin entry points before the allow_external_plugins check

Summary allowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards...

PYSEC-2026-4192

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

PYSEC-2026-4192

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

CVE-2026-105745

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

CVE-2026-105745 Docling: Plugin entry points are imported before the allow_external_plugins check

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

CVE-2026-105745 Docling: Plugin entry points are imported before the allow_external_plugins check

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

CVE-2026-105745

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...

CVE-2026-105745 Docling: Plugin entry points are imported before the allow_external_plugins check

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/basefactory.py call loadsetuptoolsentrypoints before applying the allowexternalplugins...