CVE-2026-55415: koxudaxi datamodel-code-generator code injection in generated imports

CVE-2026-55415 · Severity: high · CVSS 7.5 · Published 2026-07-28

datamodel-code-generator is a tool used to automatically create Python code from data schemas like OpenAPI or JSON Schema. A vulnerability allows a malicious schema to inject hidden commands into the generated Python files. When a developer or system later imports these generated files, the injected commands execute automatically, potentially allowing an attacker to steal sensitive data or take control of the system.

Technologies: Koxudaxi Datamodel-Code-Generator, datamodel-code-generator (PyPI). Vendors: Koxudaxi, PyPI.

Quick answers

Is CVE-2026-55415 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55415 being exploited in the wild.
How severe is CVE-2026-55415?
High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?
Koxudaxi Datamodel-Code-Generator >= 0.11.6, < 0.64.0, >= 0.11.6, <= 0.63.0; datamodel-code-generator (PyPI) ECOSYSTEM:introduced=0.11.6,fixed=0.64.0.
Is there a fix for CVE-2026-55415?
Yes. datamodel-code-generator (PyPI): upgrade to 0.64.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55415 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55415?
Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • datamodel-code-generator (PyPI): upgrade to 0.64.0 or later
    pip install "datamodel-code-generator>=0.64.0"

Technical details

A code injection vulnerability exists in datamodel-code-generator due to improper neutralization of newlines in the 'x-python-import' and 'customTypePath' schema extensions. These extensions flow unsanitized into 'Import.from_full_path' and 'Imports.create_line' within 'src/datamodel_code_generator/imports.py'. By embedding a newline character in these fields, an attacker can break out of a Python 'from ... import ...' statement to inject arbitrary module-level code. This code executes immediately when the generated Python model is imported by a downstream application. The issue is fixed in version 0.64.0 by implementing strict validation of dotted Python identifier paths.

Affected products

  • koxudaxi datamodel-code-generator >= 0.11.6, < 0.64.0

Identifiers

  • CVE-2026-55415
  • GHSA-5578-w22f-pfx9
  • PYSEC-2026-3557

Timeline

  • 2026-06-12: disclosed: Security advisory published on GitHub
  • 2026-06-14: patched: Version 0.64.0 released
  • 2026-07-28: advisory: CVE-2026-55415 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.