CVE-2026-63471: fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u/<path>/x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) – code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.
References
- github.com/advisories/GHSA-p2mm-64f6-gmpp
- github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc
- github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332
- github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1
- github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp
- nvd.nist.gov/vuln/detail/CVE-2026-63471
Code Behaviors & Features
Detect and mitigate CVE-2026-63471 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →