A flaw in fastapi-code-generator allows an attacker to inject Python code through the "responses" dictionary of a route decorator. The generator places an attacker‑controlled second response key into the dictionary as a single‑quoted string without escaping internal quotes, so a syntactically valid payload can close the string literal and introduce a new expression. When the generated module is imported, the decorator arguments are evaluated, leading to execution of arbitrary code with the privileges of the application or the CI process. This vulnerability is a classic example of code injection (CWE‑94) compounded by improper escaping (CWE‑116), and it results in full remote code execution at import time.

The impact is limited to installations of the koxudaxi:fastapi-code-generator package. Versions prior to 0.8.1 generate vulnerable code. Any project that uses the generator to produce FastAPI applications from OpenAPI definitions—and subsequently imports the generated module—falls within the affected scope.

The CVSS score of 9.3 marks the vulnerability as critical. EPSS data is not available, but the absence of a KEV listing does not diminish its severity. If an attacker can supply or influence the OpenAPI file that the generator processes, the injection can be performed remotely on a build or deployment environment. Exploitability is high because the vulnerability only requires the generation of code, which is usually done during build or documentation generation steps. Once the generated module is imported, the malicious code runs automatically, giving the attacker full control over the running process.