Is CVE-2026-63720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63720 being exploited in the wild.

How severe is CVE-2026-63720?

High severity, with a CVSS score of 7.5, published 26 July 2026.

Which products and versions are affected?

Koxudaxi Datamodel-Code-Generator < 0.70.0.

Is there a fix for CVE-2026-63720?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-63720 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63720?

Check whether you run Koxudaxi Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63720: koxudaxi datamodel-code-generator code injection in customBasePath

Q: Is there a fix for CVE-2026-63720?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-63720 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-63720?

Check whether you run Koxudaxi Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63720 · Severity: high · CVSS 7.5 · Published 2026-07-26

datamodel-code-generator is a tool used to automatically create Python code from data definitions like OpenAPI or JSON schemas. A security flaw allows an attacker to provide a specially crafted data definition that, when processed, generates a malicious Python file. If a developer or system then runs or imports this generated file, the attacker can execute arbitrary code on the system, potentially leading to a full system takeover or data theft.

Technologies: Koxudaxi Datamodel-Code-Generator. Vendors: Koxudaxi.

Quick answers

Is CVE-2026-63720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63720 being exploited in the wild.
How severe is CVE-2026-63720?: High severity, with a CVSS score of 7.5, published 26 July 2026.
Which products and versions are affected?: Koxudaxi Datamodel-Code-Generator < 0.70.0.
Is there a fix for CVE-2026-63720?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63720 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63720?: Check whether you run Koxudaxi Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in datamodel-code-generator versions prior to 0.70.0 due to improper validation of the 'customBasePath' field in input schemas. An attacker can supply a malicious value containing embedded newlines and dot-free Python expressions, which the tool emits verbatim into a generated 'from ... import ...' statement. Because the tool fails to validate these identifiers, arbitrary Python code is executed when the resulting generated module is imported by a user or automated system. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and was addressed in version 0.70.0.

Affected products

koxudaxi datamodel-code-generator < 0.70.0

Timeline

2026-07-26: advisory
2026-07-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.