Executive brief
datamodel-code-generator is a tool used to automatically create Python code from data schemas like OpenAPI or JSON Schema. A vulnerability allows a malicious schema to inject hidden commands into the generated Python files. When a developer or system later imports these generated files, the injected commands execute automatically, potentially allowing an attacker to steal sensitive data or take control of the system.
Technical details
A code injection vulnerability exists in datamodel-code-generator due to improper neutralization of newlines in the 'x-python-import' and 'customTypePath' schema extensions. These extensions flow unsanitized into 'Import.from_full_path' and 'Imports.create_line' within 'src/datamodel_code_generator/imports.py'. By embedding a newline character in these fields, an attacker can break out of a Python 'from ... import ...' statement to inject arbitrary module-level code. This code executes immediately when the generated Python model is imported by a downstream application. The issue is fixed in version 0.64.0 by implementing strict validation of dotted Python identifier paths.
Affected products
- koxudaxi datamodel-code-generator >= 0.11.6, < 0.64.0
Timeline
- 2026-06-12: disclosed: Security advisory published on GitHub
- 2026-06-14: patched: Version 0.64.0 released
- 2026-07-28: advisory: CVE-2026-55415 published to NVD