Malicious Code Injection in fastapi-middleware-cors Package
Summary
MAL-2026-1422: Malicious code in fastapi-middleware-cors (PyPI). Affects fastapi-middleware-cors versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fastapi-middleware-cors package is designed to provide CORS (Cross-Origin Resource Sharing) middleware for FastAPI applications, allowing developers to manage cross-origin requests easily. However, this package has been found to contain malicious code that executes obfuscated scripts upon import, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from a malicious actor who disguised the package as a legitimate FastAPI helper. Upon importing the module, the code executes highly obfuscated scripts that appear to include an installation beacon reporting to a Telegram channel. This malicious behavior indicates potential data exfiltration and unauthorized access to sensitive information. The package was likely created as part of a typosquatting campaign, aiming to hijack a name previously generated by AI, thus misleading developers into using it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fastapi-middleware-corsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks posed by this malicious package. The best course of action is to remove the package entirely and replace it with a secure alternative.
Conclusion
The fastapi-middleware-cors package has been identified as containing malicious code that poses significant security risks. It is essential for developers to remove this package from their projects and replace it with secure alternatives. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for fastapi-middleware-cors →
FAQ
It is a package designed to provide CORS middleware for FastAPI applications, facilitating the management of cross-origin requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should immediately uninstall the package using the command pip uninstall fastapi-middleware-cors and replace it with a secure alternative.
The risks include potential data exfiltration, unauthorized access to sensitive information, and the execution of malicious scripts within your application.
Always verify the authenticity of packages before installation, use trusted sources, and regularly monitor your dependencies for vulnerabilities.
