GitHub Advisory Databaseabout 6 hours ago
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u/ /x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression
Published November 9, 2026 · 7:48 PM
Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u/ /x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression
Source: GitHub Advisory Database
Ask AI about this articleBeta
The AI only has access to this article — it won't make up facts. Try:
Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake