GHSA-h667-4jj2-cgv4: fastapi-code-generator Lets an OpenAPI 'summary' Field Execute Code on Every Call

What happened

A new GitHub Security Advisory (GHSA-h667-4jj2-cgv4, tracked as CVE-2026-63470) reports a remote code execution flaw in fastapi-code-generator. That tool, from koxudaxi, turns OpenAPI specs into FastAPI server code. The finding was verified against version 0.8.0. The generator writes an operation's summary field into the generated route handler's docstring. It uses a triple-quoted string and does not escape embedded """ sequences. A crafted summary can close the docstring early and splice in a live Python expression, for example via __import__("os").system(...). The expression is kept syntactically valid with an or "" trick so the post-processing black/isort step does not reject it. The payload is written into the handler body as a real statement. It runs at call time, meaning when the generated endpoint is actually hit, not when the code is generated or imported. A public proof-of-concept is attached to the advisory. The report notes this is distinct from a separate issue in the same tool, an import-time injection through the route path into the @app.get(...) decorator. It is also distinct from OpenAPI Generator's unrelated python-fastapi target.

Why it matters for defenders

This is a code-generation risk, not a runtime-only one. Any team that generates a FastAPI service with fastapi-code-generator from an OpenAPI spec they do not fully trust can ship a server with an RCE sink baked into the generated source. That includes a partner-submitted spec, a spec pulled from an upstream API, or one assembled from user-influenced input. Because the trigger is simply invoking the affected endpoint, exploitation needs no further foothold once the tainted code is deployed. The advisory states other fields are escaped correctly. These include model fields handled by datamodel-code-generator, info.description, tags, and parameter defaults. The summary-into-docstring path is the specific unescaped sink.

What defenders should do now

• Inventory any services built with fastapi-code-generator. Check the version against the fix once the maintainer ships one. Treat specs from untrusted or external sources as attacker-controlled input until then.
• Review generated route handlers for docstrings with unexpected triple-quote sequences, string concatenation, or calls like __import__, os.system, or subprocess that do not match hand-written code.
• If specs come from external parties, such as partner APIs, spec marketplaces, or CI pipelines that pull third-party OpenAPI docs, validate or sanitize free-text fields like summary and any other field rendered into generated source before running codegen. Alternatively, regenerate only from vetted, pinned specs.
• For hunting, look for unusual child-process spawns or outbound connections from processes hosting generated FastAPI apps, correlated with inbound requests to specific endpoints. This is a server-side code-execution-on-request pattern, not a typical web exploit signature.
• Pin and audit codegen tool versions in your build pipeline, as you would any dependency that can execute code, since the vulnerable code is baked into source at generation time.

Developing intel

This is same-day advisory intel. A patched release was not confirmed at the time of writing. The suggested fix is to repr-escape or strip triple-quotes from the summary field before embedding it in the docstring, and to apply the same treatment to any other free-text field rendered into generated code. Track the original disclosure for updates: GHSA-h667-4jj2-cgv4.