GitHub reviewed two more critical advisories for koxudaxi fastapi-code-generator on 2026-11-09: GHSA-p2mm-64f6-gmpp (CVE-2026-63471) and GHSA-6xmv-cjr5-w3q8 (CVE-2026-63469). In both cases, attacker-controlled OpenAPI fields break out of single-quoted string literals inside generated @app.get(...) decorators and run when main.py imports—often before any client sends traffic. If you generate FastAPI apps from specs in CI, agent workflows, or internal scaffolding, upgrade to fastapi-code-generator 0.8.1 or later, regenerate committed output, and add import smoke tests that catch decorator injections.
These findings sit beside CVE-2026-63470, which we covered earlier today as a call-time docstring sink. The import-time pair changes remediation and detection: a green pytest suite that only imports routes may still execute payloads.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | fastapi-code-generator < 0.8.1 used to generate a deployed or CI-imported FastAPI app |
| Is there a fix? | 0.8.1+ escapes path and response-key literals per maintainer commits 49301db and b3b9bd6 |
| When does code run? | At import / ASGI startup, when Python evaluates decorator arguments |
| Severity? | Critical, CVSS 9.3 on both advisories (CVSS v4 vectors published on GitHub) |
| Attacker inputs? | OpenAPI path (63471) or extra response status-code key on multi-response operations (63469) |
| Agent angle? | Agents can commit poisoned decorators without a human opening main.py |
CVE-2026-63471: path string in @app.get('…')
The GHSA-p2mm-64f6-gmpp summary states that fastapi-code-generator emits each operation path into the route decorator as a single-quoted Python string without escaping embedded ' characters. A quote in the path closes the literal; concatenation ('+ expr +') injects a live expression that Python evaluates while defining the decorator—at module import, because ASGI servers import the application object at startup.
The advisory illustrates the generated shape (ellipses stand in for attacker-chosen shell commands):
@app.get('/u/' + (__import__("os").system('…') or "") + '/x', response_model=None)
def get_thing() -> None:
pass
Reporters verified the issue on fastapi-code-generator 0.8.0 with Python 3 and FastAPI. A reproduce.sh plus make_spec.py generate the app and import main.py; the injected expression runs during decorator evaluation and writes a marker—no HTTP client required.
Other OpenAPI fields are handled more carefully on affected builds: info.description, tags, and parameter defaults use quoting strategies the advisory lists as escaped. Models are emitted via datamodel-code-generator with repr escaping and are not the RCE sink here. The advisory stresses this is not OpenAPI Generator's python-fastapi backend and not the same sink as CVE-2026-63470's handler docstring.
Weaknesses: CWE-94 and CWE-116. EPSS was about 0.312% when GitHub reviewed the entry on 2026-11-09.
CVE-2026-63469: status-code keys in responses={…}
GHSA-6xmv-cjr5-w3q8 describes a second decorator sink. When an OpenAPI operation declares more than one response, the generator adds a responses={…} dict to @app.get(...). Each status-code key is written as a single-quoted string without escaping '. A malicious key can close the string and concatenate an expression evaluated at import, same as the path bug.
Example structure from the advisory:
@app.get(
'/u', response_model=None,
responses={
'404' + (__import__("os").system('…') or "") + 'x': {'model': Thing}
},
)
def get_thing() -> None:
pass
Important constraints from the write-up:
- The
responsesdict appears only when an operation has a second (non-primary) response, so exploits target additional status entries. - The response content-type key is not a sink (normalized to
'model'). operationIdmapping tofunction_namefails closed on abuse (DoS-resistant).- black and isort post-processing means syntactically invalid payloads abort generation (denial of service during codegen), while valid concatenation payloads survive and run at import.
Credits on both advisories: reporters Gal3m and mrostamipoor. Fixed in 0.8.1. Primary references include CVE-2026-63471 on NVD and CVE-2026-63469 on NVD.
Mechanism timeline: import-time vs call-time in one product
On 2026-11-09, GitHub's reviewed advisory set for fastapi-code-generator spans three distinct sinks in the same template family:
- Decorator path literal → import-time (CVE-2026-63471).
- Decorator
responsesdict keys → import-time (CVE-2026-63469). - Handler docstring from operation
summary→ call-time on first request (CVE-2026-63470, see our separate write-up).
All pre-0.8.1 versions share the vulnerable templates; one upgrade closes the class of issues the maintainers patched with literal escaping.
Attack chain (import-time)
- Spec control — Attacker influences an OpenAPI document your pipeline or agent trusts (uploaded partner spec, ticket attachment, compromised design repo).
- Codegen — fastapi-code-generator renders
main.pywith attacker text in a path or response key field. - Formatting — black/isort accept concatenation expressions that remain valid Python.
- Deploy or CI — uvicorn, gunicorn, or
import mainduring tests loads the module. - Execution — Python evaluates decorator arguments; injected
__import__("os").system(...)(or equivalent) runs with the app process user—often the same user agents use on dev laptops and CI workers.
Because execution happens at import, defenses that only scan inbound HTTP or fuzz live endpoints miss the flaw until startup—and some compromised hosts never log a malicious request.
Who is affected
Likely affected:
- Repositories with generated FastAPI code from fastapi-code-generator < 0.8.1
- Coding agents that run
fastapi-code-generatoragainst specs pulled from the web, then commitmain.py - Shared dev clusters where users upload OpenAPI to auto-provision mock APIs
- CI pipelines that
import app.mainorfrom main import appwithout static review of decorators
Lower risk:
- Teams already on 0.8.1+ who regenerated and redeployed after upgrade
- Projects using other generators (OpenAPI Generator, hand-written FastAPI) without this package
- Specs that never declare multi-response operations (63469-only) but still need path review (63471)
Verify every environment—agents create ephemeral virtualenvs per task:
pip show fastapi-code-generator
pip install --upgrade 'fastapi-code-generator>=0.8.1'
pip freeze | grep fastapi-code-generator
What to do now
Upgrade and regenerate
Pin fastapi-code-generator>=0.8.1 in requirements.txt, pyproject.toml, or Docker layers. Re-run generation against your canonical OpenAPI, then inspect decorators:
grep -n "@app\\.get" path/to/generated/main.py
grep -n "responses=" path/to/generated/main.py
Look for + concatenation inside decorator string literals— a cheap heuristic for agent-generated diffs.
Treat OpenAPI as code
- Require PR review when
pathsorresponseschange on externally sourced specs—the same discipline as API keys in logs. - If an agent fetched a spec, diff both YAML and generated Python before merge.
CI gates that catch import-time RCE
Add a version floor check to pipelines that scaffold APIs:
python3 - <<'PY'
import importlib.metadata as m
from packaging.version import Version
ver = m.version("fastapi-code-generator")
assert Version(ver) >= Version("0.8.1"), ver
PY
Run an import smoke test on generated apps in CI (import the module in a disposable container) and fail builds when decorators contain unexpected + expressions. Pair with full regeneration after upgrading—old main.py files remain dangerous even on a patched generator.
If you may have run vulnerable codegen
Rotate secrets reachable from the runtime user, rebuild images from known-good specs, and compare running containers to freshly generated artifacts. Import-time execution may leave few HTTP access logs.
What this means if you run AI coding agents
Agents optimize for "turn this OpenAPI into a running service." That workflow skips human reading of decorator lines at the top of main.py, which is exactly where both import-time sinks live. Unlike CVE-2026-63470, you do not need a later HTTP call—starting the server or importing the module in tests may be enough.
Practical habits:
- Pin generator versions in agent instructions the same way you pin
npm auditfloors in vibe-coding setups. - Deny or review agent shell patterns that downgrade packages—overlap with stopping dangerous Claude Code commands.
- Remember parallel CWE-94 lessons in agent stacks, such as vLLM
code_revisionhandling, where metadata becomes code through a different toolchain.
Vendor mitigations are escaping and validation in the generator—not runtime agent sandboxing. Your control is reviewing specs and generated Python.
Detection blind spots
Security scans tuned for SQL injection or SSRF in route handlers may ignore decorator arguments entirely. Static analysis rules that flag only function bodies miss import-time payloads. Import-only test suites pass while production workers execute malicious expressions on boot.
For multi-response APIs, remember 63469 requires an extra declared response—auditors should fuzz status keys in OpenAPI fixtures, not only paths and summaries.
Maintainer fix and what to expect in 0.8.1
Both advisories recommend the same remediation class the maintainer shipped in 0.8.1: treat decorator literals like real Python strings—escape ' and newlines (the write-ups mention repr-style encoding) before emitting @app.get('…'), and validate that paths and status-code keys match safe patterns. Commits 49301db and b3b9bd6 are linked from the GitHub entries; diff those when you vendor-pin the generator inside an agent monorepo.
Upgrading the package without regenerating leaves committed main.py files dangerous. The reporter scripts (reproduce.sh, make_spec.py) attached to the advisories are aimed at maintainers and defenders validating fixes, not at casual copying—use them as a checklist that import alone should remain side-effect free on patched builds.
If you consume specs from partners, inbound review still matters: mutual TLS on download does not sanitize paths or responses keys. Publish an internal policy that forbids checking in generated servers until both the generator version and a human or policy bot has approved decorator diffs. That pairs well with agent instructions that require git diff main.py in the PR body.
When you file internal tickets, cite all three GitHub-reviewed sinks separately—63471, 63469, and 63470—so platform teams do not assume a single WAF rule or runtime filter closes the gap. Import-time and call-time failures need different regression tests in the same pipeline. Record the generator version in deployment manifests beside Python and FastAPI pins so future agent sessions cannot silently downgrade the package during refactors.
What Beam can and cannot do here
Beam is local-first observability for Claude Code, Codex, and similar agents: it records shell commands (including pip install and codegen invocations), can deny risky PreToolUse patterns under enforce workspace policy, and redacts known credential formats before storage. It does not parse generated FastAPI decorators or OpenAPI unless you scan them as plain text—and skill scanning is heuristic, not semantic proof of malicious literals. Beam will not block Python import-time execution after code is already on disk. See what Beam watches and how local collection works.
Frequently asked questions
What are CVE-2026-63471 and CVE-2026-63469?
They are critical fastapi-code-generator issues before 0.8.1 where OpenAPI paths or extra response status keys break out of generated @app.get decorators and execute Python at import.
Which versions are affected?
All releases before 0.8.1 per the GitHub advisories. Upgrade to 0.8.1 or newer on PyPI.
Is this import-time or call-time RCE?
Import-time for both CVEs in this article. CVE-2026-63470 remains call-time via handler docstrings.
How is this different from CVE-2026-63470?
Different OpenAPI fields and code positions: decorators versus handler docstrings; import versus first HTTP request.
How do I check whether I use the vulnerable package?
Run pip show fastapi-code-generator in every environment that generates or serves generated apps.
Do coding agents make this worse?
Agents can spread poisoned decorators into repos without humans reading main.py. Import-time execution can fire during agent-driven deploys or CI collection.
Related reading
Primary sources: GHSA-p2mm-64f6-gmpp, GHSA-6xmv-cjr5-w3q8, fastapi-code-generator 0.8.1 release.
Version numbers and CVSS scores follow the GitHub advisories as of 2026-11-09.