CVE-2026-63470

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the application generation process. The root cause is the failure to escape triple quotes within the Operation.summary field when generating a route-handler docstring. An attacker-control...

CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operatio...