AIKIDO-2026-928976

TL;DR

Before the fix, parse_responses stored each non-primary response status-code key from the parsed raw_obj raw, and the generator wrote it into the route decorator's responses={...} dict as a single-quoted string without escaping. Anyone who controls or influences the OpenAPI document could close the key literal with a quote and inject a Python expression that ran when the generated module was imported by the application or CI. An operation needed a second response for the dict to be emitted, and syntax-breaking keys only aborted generation. The fix escapes every additional response status-code key with PythonEscapedString.single_quoted, blocking the injection.