FastAPI vulnerability classes

FastAPI checks that a parameter has the declared type before your function runs, which removes SQL injection for integers and enums and leaves it fully in place for every parameter declared as str.

In an async FastAPI service the shell usually enters through asyncio.create_subprocess_shell(), chosen because a blocking subprocess.run() would stall the event loop.

FastAPI endpoints look strict because every parameter has a type, and that appearance hides two ways a request can still choose code: a Pydantic type that imports by name, and handlers that load a module from a path or body value.

FastAPI's documented template path renders files by name, so template injection in a FastAPI service nearly always sits in a secondary feature (emails, PDFs, chat prompts) that compiles a string with Jinja directly.

FastAPI turns JSON into validated Pydantic models and never constructs arbitrary objects from a request, so the deserialization risk in a FastAPI service is concentrated where it stops using that path: file uploads and queues.

FastAPI will happily deliver a full file path to your function as a validated str, so a file endpoint built from the tutorial's {file_path:path} parameter and a FileResponse needs its own containment check.

A FastAPI model field typed HttpUrl guarantees a well-formed http or https URL, and that guarantee is easy to mistake for a statement about where the URL points.

FastAPI is the one framework here where the default way of writing an endpoint blocks MongoDB operator injection, because a field declared str cannot arrive as an object, so the bug appears exactly where a model says dict or Any.

Patterns declared on FastAPI parameters are checked by an engine that does not backtrack, so ReDoS in a FastAPI service comes from the places that fall back to Python's re module, some of them without the author noticing.