CVE-2026-63470

Name of the Vulnerable Software and Affected Versions fastapi-code-generator versions prior to 0.8.1

Description The software generates FastAPI applications from OpenAPI files. A flaw exists where the generator inserts the Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker who can control or influence the operation summary can close the docstring and inject a valid Python expression statement into the handler body. While syntax-breaking input causes the generation process to fail, syntactically valid injected code executes with the privileges of the server process when the affected route handler is called.

Recommendations Update fastapi-code-generator to version 0.8.1.