fastapi-code-generator lets crafted OpenAPI specs run code

Summary

fastapi-code-generator, which builds FastAPI apps from OpenAPI files, lets values in an attacker's spec insert code that runs on the server. Versions before 0.8.1 are affected.

Affected when

• App generated from an attacker-made or attacker-influenced OpenAPI spec
• Route handler is called, or the generated module is imported

What to do

Update to fastapi-code-generator 0.8.1.

Products and platforms

• fastapi-code-generator

CVE IDs

• CVE-2026-63470 (opens in a new tab)
• CVE-2026-63469 (opens in a new tab)
• CVE-2026-63471 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-03 19:13 UTC

First seen 2026-11-09 14:50 UTC