Attack Chain

1. Attacker creates a malicious OpenAPI specification containing an operation with a multi-response status-code key.
2. Attacker embeds a Python payload within the status-code string using single quotes to break the string literal context.
3. Attacker triggers the victim to run fastapi-code-generator using the malicious specification.
4. The tool generates a main.py file containing the unsanitized, injected payload within a route decorator.
5. The victim deploys the generated application to an ASGI server environment.
6. The ASGI server imports main.py at application startup, triggering the execution of the injected Python code.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the process running the FastAPI application. This poses a critical risk in environments where generated code is automatically processed or deployed via CI/CD pipelines.

Recommendation

1. Upgrade fastapi-code-generator to version 0.8.1 or later immediately to incorporate proper status-code key escaping.
2. Audit existing codebases generated by older versions of the tool for suspicious content within route decorators, specifically within the responses={...} dictionary of API endpoints.
3. Implement strict input validation on OpenAPI specifications processed by automated generation pipelines to ensure status-code keys conform to numeric or expected patterns.