CVE-2026-63720 — datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supp…
Published: 2026-07-26 · CVSS: 7.5 · CVSS 4.0
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7