https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 01:46:34 +0000 https://db.gcve.eu/vuln/cve-2026-63470 <p><strong>Affected:</strong> koxudaxi fastapi-code-generator</p> <p>fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process&#39;s privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project&#39;s separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.</p> <p><strong>Affected:</strong> koxudaxi fastapi-code-generator</p> <p>fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process&#39;s privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project&#39;s separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.</p> https://db.gcve.eu/vuln/cve-2026-63470