https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 23:18:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63471 <p>fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application&#39;s or CI process&#39;s privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project&#39;s separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.</p> <p>fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application&#39;s or CI process&#39;s privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project&#39;s separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63471