Threats tagged 'ghsa-h667-4jj2-cgv4'

fastapi-code-generator version 0.8.0 contains a critical remote code execution vulnerability (CVE-2026-63470) due to improper escaping of the operation summary field when generating route handler docstrings. An attacker can inject triple quotes in the summary to break out of the docstring and execute arbitrary Python code when the endpoint is called. This allows code execution on the server at call time. The issue is fixed in version 0.8.1 by properly escaping triple quotes in the summary before embedding it in the docstring.