fastapi-code-generator: Import-time remote code execution (CVE-2026-63471)
fastapi-code-generator versions prior to 0.8.1 contain a vulnerability that allows import-time remote code execution when processing malicious OpenAPI files by injecting arbitrary Python expressions into generated route decorators.
CVE search metadata
CVE search record: CVE-2026-63471. KEV: no. Product: fastapi-code-generator (< 0.8.1). Brief: fastapi-code-generator: Import-time remote code execution (CVE-2026-63471). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fastapi-code-generator-rce/
CVE search record: CVE-2026-63470. KEV: no. Product: fastapi-code-generator (< 0.8.1). Brief: fastapi-code-generator: Import-time remote code execution (CVE-2026-63471). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fastapi-code-generator-rce/
Triage facts
Revision 1- Applicability
- fastapi-code-generator (< 0.8.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 6 public sources
- Freshness
- Revision 1Nov 3, 21:27 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- C3Roughly even chance
What's new
- 1. added coverage for fastapi-code-generator (< 0.8.1) Nov 3, 21:27 via sploitus
Immediate actions
Upgrade fastapi-code-generator to version 0.8.1 or later
Threat Hunt
Identify projects utilizing fastapi-code-generator that process external or untrusted OpenAPI files
Data: Build pipeline logs, Source code repository analysis
Mitigations
Upgrade to fastapi-code-generator 0.8.1
CVE-2026-63470