Critical Import-Time RCE in fastapi-code-generator via Unescaped Route Path

What happened

A GitHub Security Advisory (GHSA-p2mm-64f6-gmpp, tracked as CVE-2026-63471) reports a code execution flaw in the fastapi-code-generator pip package (koxudaxi). It was verified on version 0.8.0. The tool generates a FastAPI main.py from an OpenAPI spec. It writes the spec's path field directly into the route decorator as a single-quoted Python string literal, for example @app.get('/u/<path>/x'), without escaping a ' character. A path containing a single quote can close that string literal and, through string concatenation, splice in a live Python expression. That expression runs when main.py is imported. Import happens automatically at ASGI server startup, so no HTTP request is needed to trigger it. According to the report, other string-bearing fields (info.description, tags, parameter defaults) are properly escaped. Only the path used in the @app.get(...) decorator is the unescaped sink. A maintainer report and a PoC (reproduce.sh and make_spec.py) are attached to the advisory. The reporter also distinguishes this issue from two others: OpenAPI Generator's python-fastapi backend, and a separate operation-summary docstring sink in the same product.

Why it matters for defenders

Any workflow that generates a FastAPI application with fastapi-code-generator from an attacker-controlled or attacker-influenced OpenAPI spec, and then imports or serves the generated code, is exposed to code execution at generation or startup time, before the application ever handles a request. This is relevant for CI/CD pipelines, API-spec ingestion services, codegen tooling, or any process that accepts third-party or partner-supplied OpenAPI specs and runs the generator against them. The exploit status is listed as PoC-public. The reporter estimates the severity as Critical (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). No numeric CVSS score is published in the advisory.

What defenders should watch for or do now

• Inventory where fastapi-code-generator is used, especially any pipeline that generates code from externally supplied OpenAPI specs rather than specs your own team authored.
• Treat generated main.py output as untrusted until reviewed. Inspect generated route decorators for concatenation or expression syntax (for example unexpected +, __import__, or function calls) rather than plain string literals before importing or deploying.
• Where feasible, isolate the code-generation step (ephemeral containers, no outbound network, restricted privileges) so that import-time execution during generation cannot reach sensitive systems.
• Validate or sanitize OpenAPI spec path fields (reject or escape quote characters) before they reach the generator, as a compensating control ahead of an upstream fix.
• Watch the upstream repository for a release that escapes the path value before emitting the decorator, and upgrade once it is available.

Developing intel

This is a freshly disclosed advisory with a public PoC and a suggested fix from the reporter. The advisory does not list a patched release. See the original GitHub Security Advisory for full technical detail and PoC files: GHSA-p2mm-64f6-gmpp.