{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akoxudaxifastapi-code-generator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:koxudaxi:fastapi-code-generator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-63469"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fastapi-code-generator (\u003c 0.8.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["koxudaxi"],"content_html":"\u003cp\u003efastapi-code-generator (versions prior to 0.8.1) is vulnerable to remote code execution (RCE) via improper neutralization of special elements in the status-code key of the responses dictionary. When an OpenAPI specification contains a crafted status-code string (e.g., \u003ccode\u003e'404' + __import__(\u0026quot;os\u0026quot;).system('cmd') + 'x'\u003c/code\u003e), the generator emits this into the route decorator. Because the generated code is evaluated when the FastAPI application is imported by the ASGI server, the injected expression executes immediately.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious OpenAPI specification containing an operation with a multi-response status-code key.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a Python payload within the status-code string using single quotes to break the string literal context.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the victim to run fastapi-code-generator using the malicious specification.\u003c/li\u003e\n\u003cli\u003eThe tool generates a \u003ccode\u003emain.py\u003c/code\u003e file containing the unsanitized, injected payload within a route decorator.\u003c/li\u003e\n\u003cli\u003eThe victim deploys the generated application to an ASGI server environment.\u003c/li\u003e\n\u003cli\u003eThe ASGI server imports \u003ccode\u003emain.py\u003c/code\u003e at application startup, triggering the execution of the injected Python code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the process running the FastAPI application. This poses a critical risk in environments where generated code is automatically processed or deployed via CI/CD pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade fastapi-code-generator to version 0.8.1 or later immediately to incorporate proper status-code key escaping.\u003c/li\u003e\n\u003cli\u003eAudit existing codebases generated by older versions of the tool for suspicious content within route decorators, specifically within the \u003ccode\u003eresponses={...}\u003c/code\u003e dictionary of API endpoints.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on OpenAPI specifications processed by automated generation pipelines to ensure status-code keys conform to numeric or expected patterns.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-09T22:11:34Z","date_published":"2026-11-09T22:11:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fastapi-code-generator-rce-538e69ce/","summary":"The fastapi-code-generator package fails to sanitize status-code keys in OpenAPI specifications, allowing attackers to inject and execute arbitrary Python code during the generation or subsequent import of a FastAPI application.","title":"fastapi-code-generator: Arbitrary code execution via OpenAPI spec status-code injection (CVE-2026-63469)","url":"https://feed.craftedsignal.io/briefs/2026-11-fastapi-code-generator-rce-538e69ce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:koxudaxi:fastapi-Code-Generator:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}