It affects applications generated from an attacker-controlled or attacker-influenced OpenAPI specification.The generator does not safely escape a route path before placing it in a generated Python decorator. Valid injected Python can run when the generated module is imported, including during application or CI startup.
What it allows
How Does CVE-2026-63471 Execute Code at Import Time?
fastapi-code-generator treats an OpenAPI route path as data but places it inside a generated Python string without sufficient escaping. Crafted path content can cross that boundary and become a live expression in the decorator argument.
The attack starts when a developer or pipeline generates an application from an influenced specification. The expression then runs when Python imports the generated module and evaluates its route decorator, without waiting for a web request.
Input that breaks Python syntax only stops generation. The security impact arises when the generated output stays valid and executes with the application or CI process's privileges during import.
Who is affected
All fastapi-code-generator versions before 0.8.1 are affected. GitHub's advisory identifies version 0.8.1 as patched.
Exposure depends on the provenance of OpenAPI specifications used for generation. Applications and CI pipelines that accept untrusted, externally supplied, or externally influenced route paths need priority review.
What to do
-
Upgrade the generator to version 0.8.1 or later
Replace vulnerable fastapi-code-generator versions before generating or regenerating applications. Confirm each build environment resolves version 0.8.1 or a later release.
-
Inventory generated applications and pipelines
Find applications produced with versions before 0.8.1. Record each OpenAPI specification source and whether an external party could influence its route paths.
-
Regenerate and compare trusted projects
Regenerate applications from trusted specifications with a fixed generator. Brandefense recommends reviewing route decorators and unexpected changes before deployment.
-
Review existing generated route decorators
Inspect outputs created by vulnerable versions for unexpected expressions in route decorators. Prioritize projects whose specification origin or change history cannot be verified.
-
Investigate build and startup behavior
Brandefense recommends reviewing CI and application telemetry for unexpected child processes, file changes, or outbound activity during generation, import, or startup.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-63471?
It is a critical code execution vulnerability in fastapi-code-generator. Unsafe handling of an OpenAPI route path can place executable Python into a generated route decorator.
Which fastapi-code-generator versions are affected by CVE-2026-63471?
GitHub's advisory marks every version before 0.8.1 as affected. Version 0.8.1 is the patched release.
When does code injected through CVE-2026-63471 run?
The advisory says it runs when Python imports the generated module and evaluates the route decorator. A request to the generated application is not required.
Which environments need priority review?
Prioritize applications and CI pipelines that used vulnerable generator versions with untrusted, external, or externally influenced OpenAPI specifications.
Is CVE-2026-63471 in CISA KEV?
It was not listed in CISA's Known Exploited Vulnerabilities catalog as of November 9, 2026.
