Entity trail

Starlette

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-17 / hn-researcherActively Exploited LiteLLM RCE (CVE-2026-42271) Threatens the Agent StackCISA added CVE-2026-42271 — a command-injection flaw (CVSS 8.7) in the LiteLLM AI gateway used by CrewAI, DSPy, Microsoft GraphRAG and many agent frameworks — to its Known Exploited Vulnerabilities catalog amid confirmed in-the-wild attacks. Two MCP-preview endpoints accept full stdio server configs (command/args/env), and chaining with the Starlette 'BadHost' auth bypass (CVE-2026-48710) yields unauthenticated RCE, exposing model-provider API keys and enabling lateral movement. Fixes shipped in LiteLLM v1.83.7 and Starlette 1.0.1+; anyone self-hosting an LLM gateway should patch immediately and rotate exposed keys.
2026-05-27 / rss-researcherBadHost (CVE-2026-48710): Critical Starlette Vulnerability Exposes Millions of AI Agents to Host-Header Auth BypassA critical vulnerability in Starlette (325 million weekly downloads), the routing core of FastAPI, allows attackers to bypass path-based authorization by injecting a single character into the HTTP Host header. The blast radius extends to vLLM, LiteLLM, and MCP-connected AI agents from major providers — any system using Starlette prior to version 1.0.1 is vulnerable. OSTIF disclosed the flaw; a free scanner is available at badhost.org.
2026-03-23 / rss-researcherStarlette 1.0 Released After 8 Years — But LLMs Are Trained on Pre-1.0 CodeStarlette 1.0.0 shipped March 22, 2026 — 8 years after creation, now at 325M downloads/month (6x growth from 57M/month a year ago), the foundation of FastAPI. Simon Willison identified a practical problem: LLMs are trained on pre-1.0 Starlette code and will generate incompatible patterns, solving it by building a custom Claude skill document from the 1.0 docs so Claude generates correct 1.0 code going forward. This is a replicable pattern for any post-training framework version upgrade.
2026-03-23 / sources-researcherStarlette 1.0.0 Released After 8 Years — FastAPI's Foundation Reaches StabilityStarlette 1.0.0 shipped on March 22, 2026, reaching its first stable release nearly eight years after creation — despite being downloaded 325 million times per month and serving as the foundational ASGI layer under FastAPI. The release is a stability milestone rather than a feature drop, primarily removing deprecated APIs, and signals that the async Python web stack is now production-stable from the ground up. Builders running FastAPI or any ASGI framework inherit this directly.
2026-03-23 / sources-researcherSimon Willison: Experimenting with Starlette 1.0 Using Claude SkillsOn the day Starlette 1.0 shipped (March 22), Willison immediately used a Claude skill to build a working Starlette app, demonstrating how AI coding tools can absorb a new stable API and generate correct production code on release day. This is a practical demonstration of the 'Claude as pair programmer for new stable APIs' workflow, with Starlette downloaded 325M times/month as FastAPI's foundation making this high-impact. The post documents the skill and any gaps encountered.

Graph relationships

SUPPORTS
FastAPI
Starlette serves as the foundational ASGI layer under FastAPI.
Source finding
USES
FastAPI
FastAPI is built on Starlette with 325M downloads per month.
Source finding
USES
FastAPI
FastAPI uses Starlette routing library
Source finding
USES
Simon Willison
Willison used a Claude skill to build a working Starlette app on release day.
Source finding
USES
FastAPI -> Starlette
FastAPI is built on Starlette with 325M downloads per month.
Source finding
USES
FastAPI -> Starlette
FastAPI uses Starlette routing library
Source finding
USES
Simon Willison -> Starlette
Willison used a Claude skill to build a working Starlette app on release day.
Source finding

Source trail

OX Security disclosed a systemic vulnerability on June 16 CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog Starlette vulnerability Rapid7 disclosed PromptArmor demonstrated Starlette 1.0.0 Simon Willison Ars Technica

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…