Threats tagged 'ghsa-p2mm-64f6-gmpp'

fastapi-code-generator versions prior to 0.8.1 contain a critical vulnerability where the OpenAPI path is injected into the generated FastAPI route decorator without proper escaping. This allows an attacker to craft a path containing a single quote that breaks out of the string literal and injects arbitrary Python code executed at import time, leading to remote code execution without any request needed.