{"id":"GHSA-6xmv-cjr5-w3q8","summary":"fastapi-code-generator: Import-time RCE via response status-code key -\u003e unescaped @app.get(..., responses={...}) dict","details":"### Summary\n\nfastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request. The status-code key is a pure data field. Verified on\nfastapi-code-generator 0.8.0 / Python 3 / FastAPI.\n\n### Details\n\n```python\n@app.get(\n '/u', response_model=None,\n responses={\n '404' + (__import__(\"os\").system('…') or \"\") + 'x': {'model': Thing}\n },\n)\ndef get_thing() -\u003e None:\n pass\n```\n\nThe responses={...} dict is emitted only when the operation has a second (non-primary) response, so the malicious key is any additional response status. The generator post-processes with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat ('+expr+', kept valid with (... or \"\")) is written and runs at import. The response content-type key is NOT a sink (normalized to 'model'). info.* are repr-escaped; operationId -\u003e function_name fails closed (DoS-resistant).\n\nNot a duplicate: same product as the path -\u003e @app.get('…') and summary -\u003e handler-docstring findings, but a different field (response status-code key) and position (the responses={...} decorator dict key). Distinct from OpenAPI Generator's python-fastapi. Models come from datamodel-code-generator (repr-escaped).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates the app and merely imports main.py; the injected expression runs at decorator evaluation and writes a marker. Verified on 0.8.0.\n\n### Impact\n\nCode execution at import/startup in any application/CI that generates a FastAPI app with\nfastapi-code-generator from an attacker-controlled or attacker-influenced spec (multi-response operation)\nand imports/serves it. Estimated Critical, e.g. `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`.\n\n### Suggested fix\n\nEscape each response status-code key for the Python string literal (escape ', \\, newlines via repr) before emitting the responses={...} dict, and validate that status-code keys are numeric / a known pattern. [maintainer-report.txt](https://github.com/user-attachments/files/29534524/maintainer-report.txt) [make_spec.py](https://github.com/user-attachments/files/29534526/make_spec.py) [reproduce.sh](https://github.com/user-attachments/files/29534527/reproduce.sh)","aliases":["CVE-2026-63469"],"modified":"2026-11-09T20:00:04.179557445Z","published":"2026-11-09T19:46:27Z","database_specific":{"cwe_ids":["CWE-116","CWE-94"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-11-09T19:46:27Z","nvd_published_at":"2026-11-03T20:18:15Z"},"references":[{"type":"WEB","url":"https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-6xmv-cjr5-w3q8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63469"},{"type":"WEB","url":"https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc"},{"type":"WEB","url":"https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332"},{"type":"PACKAGE","url":"https://github.com/koxudaxi/fastapi-code-generator"},{"type":"WEB","url":"https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"}],"affected":[{"package":{"name":"fastapi-code-generator","ecosystem":"PyPI","purl":"pkg:pypi/fastapi-code-generator"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3rc0","0.5.4","0.6.0","0.7.0","0.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}