CVE-2026-63469

{
  "etk_id": "ETK-2026-4003",
  "cve_id": "CVE-2026-63469",
  "display_id": "CVE-2026-63469",
  "ghsa_id": "GHSA-6xmv-cjr5-w3q8",
  "euvd_id": "EUVD-2026-116146",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OpenAPI response-key code injection in fastapi-code-generator",
  "summary": "fastapi-code-generator versions before 0.8.1 may produce generated Python that executes during module import. An attacker needs control or influence over an OpenAPI document with an additional response entry, and the generated application must be imported or started, such as in CI or an application deployment.",
  "mitigation": "Upgrade fastapi-code-generator to version 0.8.1 or later. Until upgraded, generate code only from trusted OpenAPI documents and reject response status-code keys that do not match expected numeric formats.",
  "vendor": "pip",
  "product": "fastapi-code-generator",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.8.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "0.8.1"
      ],
      "package_name": "fastapi-code-generator",
      "purl": "pkg:pypi/fastapi-code-generator"
    }
  ],
  "cwes": null,
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0031,
  "epss_percentile": 0.2431,
  "epss_asof": "2026-11-09",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.919904133333333,
  "t0_at": "2026-11-03T19:15:54.707000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T19:15:54.707000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T19:15:54.707000+00:00",
      "url": "https://github.com/advisories/GHSA-6xmv-cjr5-w3q8"
    }
  }
}