GitHub rated fastapi-code-generator critical under GHSA-h667-4jj2-cgv4 (CVE-2026-63470): an OpenAPI summary field can break out of a generated route handler docstring and run attacker Python the first time the endpoint is called. If you use koxudaxi/fastapi-code-generator in CI, scaffolding scripts, or agent workflows that turn specs into apps, upgrade to 0.8.1 or later, regenerate any committed output, and audit OpenAPI files you did not author yourself.
This is not the OpenAPI Generator python-fastapi target. Here the sink is the operation summary rendered into the handler docstring.
Update (Nov 9, 2026): import-time decorator sinks reviewed
GitHub reviewed two additional critical advisories in the same fastapi-code-generator release line on 2026-11-09: GHSA-p2mm-64f6-gmpp (CVE-2026-63471, unescaped path in @app.get('…')) and GHSA-6xmv-cjr5-w3q8 (CVE-2026-63469, unescaped response status-code keys in responses={…}). Both execute when main.py imports, not on first HTTP request. They share the 0.8.1 fix with this call-time summary issue. See our import-time breakdown for decorator-focused checks and CI import smoke tests.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | fastapi-code-generator < 0.8.1 used to generate a deployed FastAPI app |
| Is there a fix? | 0.8.1+ escapes summary text for docstrings |
| When does code run? | On HTTP request to the poisoned route (call-time, not import-time) |
| Severity? | Critical, CVSS 9.3 (v4 vector in advisory) |
| Attacker input? | OpenAPI operation summary in a spec the generator reads |
| Agent angle? | Agents can regenerate apps from untrusted specs without showing you the handler body |
What the advisory says
The GitHub-reviewed advisory, updated 2026-11-09, describes how fastapi-code-generator maps each operation's summary into the generated async function's docstring using a triple-quoted string without escaping embedded """.
A summary like the following is not literal user data; it illustrates the structure the reporters used:
def get_thing() -> None:
(
"""
x"""
+ (__import__("os").system('…') or "")
+ """y
"""
)
pass
The generator runs black and isort, so payloads must stay syntactically valid Python. The reporters used concatenation (""" + expr + """) so formatting tools accept the handler. The expression executes when the route handler runs — when a client hits the endpoint.
Other OpenAPI fields are handled differently: the advisory notes that info.description, tags, and parameter defaults are escaped; operation description is not emitted into the function body. Models come from datamodel-code-generator with repr escaping and are not the RCE sink.
Impact: remote code execution on the server hosting the generated app, for any deployment built from an attacker-controlled or attacker-influenced spec.
Weaknesses: CWE-94 (code injection) and CWE-116 (improper escaping). CVSS v4 base score 9.3 with network attack vector, no privileges, and no user interaction on the vulnerable system. The advisory was GitHub-reviewed on 2026-11-09 after initial publication in July 2026.
Credits: Gal3m and mrostamipoor as reporters. Fixed in 0.8.1 with commits linked from the advisory.
Mechanism, step by step
- Input — Developer or agent points fastapi-code-generator at an OpenAPI document (local file, fetched URL, or paste).
- Generation — For each operation, the tool writes a FastAPI route function. The
summarystring becomes a docstring in the function body using unescaped"""delimiters on affected versions. - Breakout — Attacker supplies
"""insidesummaryto terminate the docstring early, then adds a Python expression via string concatenation that black/isort leave intact. - Deploy — Generated
main.py(or equivalent) ships to a server. Importing the module may succeed because the malicious fragment is structured as an expression statement tied to call flow. - Trigger — First HTTP request that dispatches to that route executes the injected expression with the app process privileges — often full API server access on cloud VMs agents provision.
Because execution is call-time, static importers and some CI tests that only import modules may miss the flaw unless they actually invoke routes. The same “config looks safe, runtime isn’t” pattern shows up in industrial stacks too—see CVE-2026-95860 node-opcua RBAC fail-open.
Who is affected
In scope:
- Repositories with generated FastAPI code produced by fastapi-code-generator versions before 0.8.1
- Pipelines where coding agents regenerate APIs from specs pulled from tickets, partner portals, or compromised design docs
- Internal platforms that let users upload OpenAPI to spin up mock services on shared dev clusters
Lower risk:
- Projects on 0.8.1+ after a full regenerate
- Teams using a different generator (OpenAPI Generator, manual FastAPI) without this package
- Specs that never pass through koxudaxi's tool
The advisory's proof of concept was verified on 0.8.0 with Python 3 and FastAPI. Check every virtualenv — agents often create ephemeral envs per task.
What to do now
Version check and upgrade:
pip show fastapi-code-generator
pip install --upgrade 'fastapi-code-generator>=0.8.1'
Confirm CI images and Dockerfiles pin the new floor:
pip freeze | grep fastapi-code-generator
Regenerate and diff:
Re-run the generator against your canonical spec, then git diff handlers. Search for odd docstring concatenation:
grep -R '"""' path/to/generated/ | head
Treat specs as code:
- Sign or review OpenAPI files in PRs the same way you review Python.
- If an agent fetched a spec from the web, assume summary fields are untrusted until sanitized.
Runtime detection:
- Hit staging routes with harmless traffic after deploy; unexpected subprocess or file writes from a read-only GET handler are a red flag.
- Review application logs for errors on first access to new endpoints.
If you may already be compromised:
Rotate secrets reachable from the app host, redeploy from known-good generated sources, and compare running containers to rebuilt artifacts.
What this means if you run AI coding agents
Agents excel at "take this OpenAPI and scaffold a service." That shortens development but shifts trust to machine-readable inputs humans skip. CVE-2026-63470 is a concrete example: a single summary string becomes executable logic without appearing in the route decorator path operators monitor.
Pair generator upgrades with habits we cover elsewhere:
- Diff agent commits before merge, the same discipline as stopping dangerous Claude Code commands.
- Watch for agents running
pip install fastapi-code-generatorin unknown versions inside vibe-coding setups. - Remember other CWE-94 bugs in agent stacks, such as vLLM
code_revisionhandling, where untrusted metadata becomes code — different product, same lesson.
There is no AI-specific mitigation in the vendor fix beyond upgrading and escaping; your control is supply-chain review of specs and generated Python.
How this differs from other fastapi-code-generator issues
The advisory is explicit that GHSA-h667-4jj2-cgv4 is not a duplicate of OpenAPI Generator's python-fastapi templates, and distinct from import-time decorator issues now tracked as CVE-2026-63471 and CVE-2026-63469. Here the attacker field is summary, the sink is the handler docstring inside the function body, and execution waits for a request.
That distinction changes detection:
- SAST rules watching decorators may miss docstring injections.
- Import-only test suites pass while production traffic triggers the payload.
- Agents that "fix" OpenAPI by editing summaries can introduce exploit text without touching paths or operationIds.
The maintainer's recommended fix class — escape """ and backslashes (or strip triple quotes) before embedding any free-text field in a docstring — is standard CWE-116 hygiene. The surprise is that a widely used generator escaped other fields but not the one copied into executable scope.
CI and code-review checks that catch call-time RCE
Add generator version gates to lockfiles and Docker layers:
python3 - <<'PY'
import importlib.metadata as m
ver = m.version("fastapi-code-generator")
from packaging.version import Version
assert Version(ver) >= Version("0.8.1"), ver
PY
In pull requests that touch generated handlers:
- Fail CI if
fastapi-code-generatorappears below 0.8.1. - Grep generated sources for docstrings that concatenate strings with
+immediately after"""closures — a cheap heuristic, not proof, but useful for agent-generated diffs. - Require human review when the OpenAPI diff changes
summaryon externally sourced specs.
For agents, add instruction files that forbid committing generated API servers until pip show confirms the patched generator version, mirroring how teams pin npm audit floors for front-end scaffolding.
Blasting radius on typical agent hosts
Compromised route handlers usually run as the same user that launched uvicorn or gunicorn. On a developer laptop that user can read SSH keys, cloud CLIs, and .env files in the repo the agent bootstrapped. On a shared dev cluster, one poisoned spec can pivot across namespaces if the service account is over-permissioned.
That is why call-time RCE in a small dev utility still belongs in agent-security runbooks: the attacker does not need a CVE in Claude itself if they can supply the OpenAPI your agent obediently compiles.
Reporter artifacts and verification steps
The GitHub advisory links maintainer correspondence, reproduce.sh, and make_spec.py used to demonstrate the issue on 0.8.0. If you maintain an internal golden OpenAPI file for regression tests, add a negative test whose summary contains escaped-quote edge cases and assert the generated handler contains no free-floating expression statements after docstrings. Keep that test in human-reviewed code even when agents regenerate the app skeleton.
When you upgrade, record the generator version in your deployment manifest the same way you record Python runtime and FastAPI versions. Future agent sessions are less likely to downgrade the package if the floor is encoded in requirements.txt or pyproject.toml comments agents are instructed to respect.
If your organization publishes OpenAPI to partners, treat outbound summary fields as untrusted on ingest as well: a partner could fingerprint your generator version from error pages, then return a spec crafted for older builds. Mutual TLS on spec download does not sanitize field contents. Rotate generated service credentials after any incident where an old generator may have produced handlers you did not manually inspect.
What Beam can and cannot do here
Beam watches Claude Code and Codex locally: it logs shell commands such as pip install and fastapi-code-generator invocations, can deny risky PreToolUse patterns under enforce policy, and redacts known secret formats before storage. It does not statically analyze generated FastAPI handlers or OpenAPI files unless you point its skill scan at them as plain text — and that scan is heuristic, not semantic. Beam will not block HTTP traffic to an already-deployed vulnerable route. See what Beam watches.
Frequently asked questions
What is CVE-2026-63470?
It is critical RCE in fastapi-code-generator before 0.8.1. The tool copies each OpenAPI operation summary into a route handler docstring without escaping triple quotes, so attacker-controlled summary text can break out and add executable Python that runs when the route is invoked.
Which versions are affected?
All fastapi-code-generator releases before 0.8.1 per GHSA-h667-4jj2-cgv4. Patched version is 0.8.1.
Is this import-time or call-time RCE?
Call-time. The injected expression runs when a client calls the HTTP endpoint.
How do I check whether I use the vulnerable package?
Run pip show fastapi-code-generator in every environment that generates or serves generated apps.
Do coding agents make this worse?
Agents can spread poisoned summaries into generated repos without a human reading handler bodies. Diff specs and generated Python on every agent PR.
Is there a public exploit?
The advisory includes reporter proof-of-concept scripts verified on 0.8.0. EPSS was about 0.468% at advisory review time.
Related reading
- vLLM CVE-2026-114053: code revision remote code execution
- Langflow MCP stdio RCE (agent toolchain precedent)
- How to vibe-code more safely with Beam
- Stop dangerous Claude Code commands before they run
- API keys in logs and env vars: how they leak
- CVE-2026-118740: .NET Aspire Dashboard NotFound route telemetry deletion
Primary sources: GHSA-h667-4jj2-cgv4, CVE-2026-63470 on NVD, fastapi-code-generator 0.8.1 release.
Version numbers and CVSS scores follow the GitHub advisory as of 2026-11-09.