GHSA-h667-4jj2-cgv4: fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fastapi-code-generatorto a version that resolves this vulnerability.Fixed in 0.8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations that use fastapi-code-generator versions before 0.8.1 to generate FastAPI applications from OpenAPI files are exposed when an attacker can control or influence an operation summary in an input specification. The generated application is affected rather than the generator alone.
What must happen for code execution to occur?
The malicious operation summary must contain embedded triple quotes that produce syntactically valid Python and inject an expression statement into the generated route handler. The injected code executes when the affected handler is called, with the server process's privileges; malformed input only causes generation to fail.
Is this an import-time execution issue?
No. This sink is reached at route-handler call time, not when the generated module is imported. It is separate from the project's import-time route-path and additional-response-key sinks.
How can I determine whether generated code is affected?
Review applications generated with versions earlier than 0.8.1 for route-handler docstrings built from operation summaries, especially summaries containing triple-double-quote sequences. Determine whether the resulting handler body contains unexpected Python expression statements after the docstring is closed.
What version fixes the issue?
Upgrade fastapi-code-generator to version 0.8.1, which fixes this issue. Regenerate affected applications from reviewed OpenAPI input after upgrading.