Junglewise Threat Intelligence

CVE-2026-63720: koxudaxi datamodel-code-generator code injection in customBasePath

CVE-2026-63720 · Severity: high · CVSS 7.5 · Published 2026-07-26

Technologies: Koxudaxi Datamodel-Code-Generator. Vendors: Koxudaxi.

Executive brief

datamodel-code-generator is a tool used to automatically create Python code from data definitions like OpenAPI or JSON schemas. A security flaw allows an attacker to provide a specially crafted data definition that, when processed, generates a malicious Python file. If a developer or system then runs or imports this generated file, the attacker can execute arbitrary code on the system, potentially leading to a full system takeover or data theft.

Technical details

A code injection vulnerability exists in datamodel-code-generator versions prior to 0.70.0 due to improper validation of the 'customBasePath' field in input schemas. An attacker can supply a malicious value containing embedded newlines and dot-free Python expressions, which the tool emits verbatim into a generated 'from ... import ...' statement. Because the tool fails to validate these identifiers, arbitrary Python code is executed when the resulting generated module is imported by a user or automated system. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and was addressed in version 0.70.0.

Affected products

  • koxudaxi datamodel-code-generator < 0.70.0

Timeline

  • 2026-07-26: advisory
  • 2026-07-26: disclosed

References

Related threats