The vulnerability arises when fastapi-code-generator inserts the operation.summary field from an OpenAPI specification directly into a generated route‑handler docstring without escaping embedded triple quotes. An attacker who can influence the operation.summary can terminate the docstring and inject a valid Python expression statement into the handler body. When the affected route handler is invoked, the injected code runs with the server process’s privileges, providing full remote code execution. This is a classic code‑injection flaw, classified as CWE‑94 and CWE‑116, with a CVSS score of 9.3 indicating critical severity.

The flaw exists in the koxudaxi fastapi-code-generator product. All product releases prior to version 0.8.1 are affected. Any FastAPI application that was generated by this tool using an older version, especially when the OpenAPI specification’s operation summaries are under attacker control, could be vulnerable.

Without a patch, an attacker who can supply or modify the OpenAPI specification used to generate the application can embed arbitrary Python code. Because the exploitation occurs at runtime when the route is called, the attack requires the target server to host the generated application. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The CVSS score of 9.3 demonstrates high impact and potential for widespread exploitation if untrusted OpenAPI definitions are used.