Executive brief
datamodel-code-generator is a tool used to automatically create Python code from data definitions like OpenAPI or JSON schemas. A security flaw allows an attacker to provide a specially crafted data definition that, when processed, generates a malicious Python file. If a developer or system then runs or imports this generated file, the attacker can execute arbitrary code on the system, potentially leading to a full system takeover or data theft.
Technical details
A code injection vulnerability exists in datamodel-code-generator versions prior to 0.70.0 due to improper validation of the 'customBasePath' field in input schemas. An attacker can supply a malicious value containing embedded newlines and dot-free Python expressions, which the tool emits verbatim into a generated 'from ... import ...' statement. Because the tool fails to validate these identifiers, arbitrary Python code is executed when the resulting generated module is imported by a user or automated system. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and was addressed in version 0.70.0.
Affected products
- koxudaxi datamodel-code-generator < 0.70.0
Timeline
- 2026-07-26: advisory
- 2026-07-26: disclosed