Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (`@app.get('/u/ /x')`) without escaping the `'`. A `'` in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. Details ```python @app.get('/u/'+(import("os").system('…') or "")+'/x', response_model=None) def get_thing() -> None: pass ``` The generator post-processes output with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat (`'+expr+'`, kept valid with `(… or "")`) is written and runs at import. info.description (`description='…'`), tags, and parameter defaults are `'`-escaped; the path in @app.get('…') is the unescaped sink.…
Recommended action: Upgrade to 0.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request. The status-code key is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. Details ```python @app.get( '/u', response_model=None, responses={ '404' + (import("os").system('…') or "") + 'x': {'model': Thing} }, ) def get_thing() -> None: pass ``` The responses={...} dict is emitted only when the operation has a second (non-primary) response, so the malicious key is any additional response status. The generator post-processes with black/isort, so a syntax-breaking payload aborts generation…
Recommended action: Upgrade to 0.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
fastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `"""`. A `"""` in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. Details ```python def get_thing() -> None: ( """ x""" + (import("os").system('…') or "") + """y """ ) pass ``` The generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout (`"""+expr+"""`, kept valid with `(… or "")`) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models…
Recommended action: Upgrade to 0.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.