Comment by agolio

Fully agree, worth re-iterating as the title doesn't make it clear.

The vulnerability is not in FastAPI itself, but in a relatively unknown utility package that you probably aren't using.

Still good to raise awareness but a slight bit of scaremongering