GHSA-p2mm-64f6-gmpp

Suggest an improvement
Source
https://github.com/advisories/GHSA-p2mm-64f6-gmpp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p2mm-64f6-gmpp
Aliases
Published
2026-11-09T19:48:08Z
Modified
2026-11-09T20:00:04Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
Details

Summary

fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u/<path>/x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.

Details

@app.get('/u/'+(__import__("os").system('…') or "")+'/x', response_model=None)
def get_thing() -> None:
 pass

The generator post-processes output with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat ('+expr+', kept valid with (… or "")) is written and runs at import. info.description (description='…'), tags, and parameter defaults are '-escaped; the path in @app.get('…') is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).

Not a duplicate: distinct product from OpenAPI Generator's python-fastapi backend (different codebase/template/decorator); and distinct from the operation-summary docstring sink in the same product.

PoC

reproduce.sh (+ make_spec.py) attached: generates the app and merely imports main.py; the injected expression runs at decorator evaluation and writes a marker. Verified on 0.8.0.

Impact

Code execution at import/startup in any application/CI that generates a FastAPI app with fastapi-code-generator from an attacker-controlled or attacker-influenced spec and imports/serves it. Estimated Critical, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Suggested fix

Escape the path for the Python string literal (escape ', , newlines via repr) before emitting @app.get('…'), and validate path characters.

maintainer-report.txt make_spec.py reproduce.sh

Database specific 
{
    "cwe_ids": [
        "CWE-116",
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-09T19:48:08Z",
    "nvd_published_at": "2026-11-03T20:18:15Z",
    "severity": "CRITICAL"
}
References

Affected packages

PyPI / fastapi-code-generator

Package

Name
fastapi-code-generator
View open source insights on deps.dev
Purl
pkg:pypi/fastapi-code-generator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3rc0
0.5.3
0.5.4
0.6.0
0.7.0
0.8.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json"