GHSA-H667-4JJ2-CGV4 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Summary fastapi-code-generator koxudaxi emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in t...

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Summary fastapi-code-generator koxudaxi emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in t...