What’s Vulnerable › Vulnerabilities

CVE-2026-63720: datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-26 · updated 2026-10-24
• Weakness: CWE-94

Description

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

Affected products

• koxudaxi datamodel-code-generator: before 0.70.0 — fixed in 0.70.0

How to fix

Upgrade to a fixed version: koxudaxi datamodel-code-generator 0.70.0. Check the vendor advisory for mitigations.

References

• https://github.com/koxudaxi/datamodel-code-generator
• https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5
• https://github.com/rahulreddykarne/CVE-2026-63720-datamodel-code-generator
• https://rahulkarne.com/#/cve/CVE-2026-63720
• https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field

Get alerted when CVE-2026-63720 or the next vulnerability affects your stack