koxudaxi — fastapi-code-generator
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.
Available for technologies you monitor inside Seraph CTI.
Surfaced automatically when a documented actor is linked to this CVE.
Shown when this vendor/product is relevant to your industry.
Campaign and indicator context, where Seraph analysts have published it.
Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.
