Description
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
koxudaxi datamodel-code-generator
Default version status: affected
0 to < 0.70.0affected
References
- https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5 ↗
- https://github.com/koxudaxi/datamodel-code-generator ↗
- https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field ↗
- https://rahulkarne.com/#/cve/CVE-2026-63720 ↗
- https://github.com/rahulreddykarne/CVE-2026-63720-datamodel-code-generator ↗