CVE-2026-63469: fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

### Summary fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) -- code execution, no request. The status-code key is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI. ### Details ```python @app.get( '/u', response_model=None, responses={ '404' + (__import__("os").system('…') or "") + 'x': {'model': Thing} }, ) def get_thing() -> None: pass ``` The responses={...} dict is emitted only when the operation has a second (non-primary) response, so the malicious key is any additional response status. The generator post-processes with black/isort, so a syntax-breaking payload aborts generation (DoS); a valid-Python concat ('+expr+', kept valid with (... or "")) is written and runs at import. The response content-type key is NOT a sink (normalized to 'model'). info.* are repr-escaped; operationId -> function_name fails closed (DoS-resistant). Not a duplicate: same product as the path -> @app.get('…') and summary -> handler-docstring findings, but a different field (response status-code key) and position (the responses={...} decorator dict key). Distinct from OpenAPI Generator's python-fastapi. Models come from datamodel-code-generator (repr-escaped). ### PoC `reproduce.sh` (+ `make_spec.py`) attached: generates the app and merely imports main.py; the injected expression runs at decorator evaluation and writes a marker. Verified on 0.8.0. ### Impact Code execution at import/startup in any application/CI that generates a FastAPI app with fastapi-code-generator from an attacker-controlled or attacker-influenced spec (multi-response operation) and imports/serves it. Estimated Critical, e.g. `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`. ### Suggested fix Escape each response status-code key for the Python string literal (escape ', \, newlines via repr) before emitting the responses={...} dict, and validate that status-code keys are numeric / a known pattern. [maintainer-report.txt](https://github.com/user-attachments/files/29534524/maintainer-report.txt) [make_spec.py](https://github.com/user-attachments/files/29534526/make_spec.py) [reproduce.sh](https://github.com/user-attachments/files/29534527/reproduce.sh)