Code Injection Vulnerability in datamodel-code-generator by koxudaxi
CVE-2026-63720

7.5HIGH

Key Information:

Vendor

Koxudaxi

Status
Datamodel-code-generator
Vendor
CVE Published:
26 July 2026

What is CVE-2026-63720?

The datamodel-code-generator prior to version 0.70.0 is susceptible to a code injection issue that enables attackers with control over input schemas to execute arbitrary Python code. By providing a malicious customBasePath value—which includes embedded newlines and a dot-free Python expression—an attacker can alter a generated 'from ... import ...' statement. The absence of identifier validation leads to the execution of unintended Python code when the resultant module is imported.

Affected Version(s)

datamodel-code-generator 0

References

https://github.com/koxudaxi/datamodel-code-generator/comm...
productpatch
https://github.com/koxudaxi/datamodel-code-generator
product
https://www.vulncheck.com/advisories/datamodel-code-gener...
third-party-advisory

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rahul Karne
.