Versions before 0.8.1 can place an unescaped additional response status-code key into generated Python code.A crafted OpenAPI specification can turn that data into an executable expression. The expression runs when the generated module is imported, including during application startup or a CI job.
What it allows
How Does CVE-2026-63469 Trigger Import-Time Code Execution?
fastapi-code-generator builds FastAPI applications from OpenAPI documents. In vulnerable releases, it writes an additional response status-code key into a generated route decorator without safely escaping special characters.
The vulnerable path requires an operation with more than one response. If an attacker controls or influences the second non-primary response key, that key can alter the meaning of the generated Python expression.
Merely breaking Python syntax stops generation. A syntactically valid expression remains in the generated module and executes when the application or CI process imports that module.
The code therefore runs before an HTTP request reaches the generated application. Its privileges match the application or CI process that performs the import.
Who is affected
All fastapi-code-generator versions before 0.8.1 are affected. Version 0.8.1 contains the fix.
Exposure requires an attacker-controlled or attacker-influenced OpenAPI specification with a multi-response operation. Teams that generate code only from trusted, reviewed specifications have a narrower attack surface, but should still upgrade.
What to do
-
Upgrade to version 0.8.1 or later
Replace every fastapi-code-generator release before 0.8.1. Verify the installed version in developer workstations, build images, CI runners, and other code-generation environments.
-
Inventory OpenAPI code-generation workflows
Identify where teams accept OpenAPI documents and generate or import FastAPI modules. Prioritize workflows that accept specifications from external contributors, uploads, forks, or automated integrations.
-
Treat specifications as executable build input
Brandefense recommends requiring review and provenance checks before code generation. Do not automatically import generated modules from untrusted or unreviewed specifications.
-
Review CI and startup telemetry
Brandefense recommends checking code-generation jobs and application startups for unexplained child processes, file changes, network activity, credential access, or failed generation attempts.
-
Reduce generator privileges
Run code generation and validation with minimal filesystem, network, and secret access. Isolate CI jobs so a malicious specification cannot inherit unnecessary application or deployment privileges.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-63469?
It is a critical code-generation vulnerability in fastapi-code-generator. An unsafe additional response key can become executable Python when a generated module is imported.
Which fastapi-code-generator versions are affected?
All versions before 0.8.1 are affected. The project identifies version 0.8.1 as the patched release.
When does CVE-2026-63469 execute?
A valid injected expression executes when the generated Python module is imported. This may occur during application startup or inside a CI process, without an HTTP request.
Which workflows are exposed to CVE-2026-63469?
The vulnerable path requires a multi-response OpenAPI operation and attacker control or influence over an additional response key. Automated generation from external specifications deserves priority.
How should teams mitigate CVE-2026-63469?
Upgrade to 0.8.1 or later, restrict untrusted specifications, review generated code before import, isolate build jobs, and inspect CI or startup telemetry.
Sources
- GitHub Advisory GHSA-6xmv-cjr5-w3q8GitHub
- NVD: CVE-2026-63469NIST NVD
