fastapi-code-generator: Arbitrary code execution via OpenAPI spec status-code injection (CVE-2026-63469)

fastapi-code-generator (versions prior to 0.8.1) is vulnerable to remote code execution (RCE) via improper neutralization of special elements in the status-code key of the responses dictionary. When an OpenAPI specification contains a crafted status-code string (e.g., '404' + __import__("os").system('cmd') + 'x'), the generator emits this into the route decorator. Because the generated code is evaluated when the FastAPI application is imported by the ASGI server, the injected expression executes immediately.

Attack Chain

1. Attacker creates a malicious OpenAPI specification containing an operation with a multi-response status-code key.
2. Attacker embeds a Python payload within the status-code string using single quotes to break the string literal context.
3. Attacker triggers the victim to run fastapi-code-generator using the malicious specification.
4. The tool generates a main.py file containing the unsanitized, injected payload within a route decorator.
5. The victim deploys the generated application to an ASGI server environment.
6. The ASGI server imports main.py at application startup, triggering the execution of the injected Python code.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the process running the FastAPI application. This poses a critical risk in environments where generated code is automatically processed or deployed via CI/CD pipelines.

Recommendation

1. Upgrade fastapi-code-generator to version 0.8.1 or later immediately to incorporate proper status-code key escaping.
2. Audit existing codebases generated by older versions of the tool for suspicious content within route decorators, specifically within the responses={...} dictionary of API endpoints.
3. Implement strict input validation on OpenAPI specifications processed by automated generation pipelines to ensure status-code keys conform to numeric or expected patterns.