Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

Fix availableCritical · CVSS 9.3EPSS 0.31%

Published Nov 9, 2026 · updated Nov 9, 2026

What to do

  1. Upgrade to a fixed version: fastapi-code-generator 0.8.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIfastapi-code-generator29,432 downloads/week

Vulnerable versions
< 0.8.1
Fixed in
0.8.1

Check your project: pip show fastapi-code-generator

What changed

  1. Nov 9, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-94 Improper Control of Generation of Code · CWE-116 Improper Encoding or Escaping of Output

← All critical vulnerabilities