CVE-2026-63720

HIGH 7.5

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

CWE	CWE-94
Vendor	koxudaxi
Product	datamodel-code-generator
Published	Jul 26, 2026

Stay Ahead of the Next One

Get instant alerts for koxudaxi datamodel-code-generator

Be the first to know when new high vulnerabilities affecting koxudaxi datamodel-code-generator are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

koxudaxi / datamodel-code-generator

0 < 0.70.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5 github.com: https://github.com/koxudaxi/datamodel-code-generator vulncheck.com: https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field

Credits

🔍 Rahul Karne