Skip to content
Critical RCE Vulnerability in fastapi-code-generator Disclosed

Critical RCE Vulnerability in fastapi-code-generator Disclosed

First seen 10 Nov 2026, 19:51 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 19:52 UTC
  • •CVE-2026-63469 is a critical RCE vulnerability with a CVSS score of 9.3.
  • •All versions of fastapi-code-generator before 0.8.1 are affected.
  • •Immediate upgrade to version 0.8.1 is recommended to mitigate the risk.

CVE-2026-63469, a critical remote code execution vulnerability in fastapi-code-generator, was published on November 3, 2026, with a CVSS score of 9.3. The flaw affects all versions prior to 0.8.1, allowing attackers to inject executable code through unescaped response status-code keys in generated Python code. This vulnerability can be triggered when a crafted OpenAPI specification is used, particularly in operations with multiple responses. The malicious code executes upon importing the generated module, which can occur during application startup or CI jobs. Users are advised to upgrade to version 0.8.1 or later and to review their OpenAPI code-generation workflows to mitigate risks. The vulnerability requires an attacker-controlled OpenAPI specification to exploit effectively.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-03
CVE-2026-63469 published
A critical RCE vulnerability in fastapi-code-generator was disclosed, affecting versions before 0.8.1.
Brandefense
2026-11-10
Advisory published on GitHub
GitHub released an advisory detailing the RCE vulnerability and its exploitation method in fastapi-code-generator.
github.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-63469 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (1)

1 / 2

Common questions

Which versions are affected?
All versions of fastapi-code-generator prior to 0.8.1 are affected.
Is there a patch available?
Yes, version 0.8.1 of fastapi-code-generator includes a fix for this vulnerability.
What should users do to protect themselves?
Users should upgrade to version 0.8.1 or later and review their OpenAPI code-generation workflows.