CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

CVE-2026-63469

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the application generation process. The root cause is a code injection vulnerability where the generator inserts a response status-code key into a generated responses={...} route-decorato...