# CVE-2026-63720: koxudaxi datamodel-code-generator code injection in customBasePath

Source: https://junglewise.ai/threats/cve-2026-63720-koxudaxi-datamodel-code-generator-code-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-26. Updated: 2026-07-26  
License: CC BY 4.0 with a link back

CVE-2026-63720 · Severity: high · CVSS 7.5 · Published 2026-07-26

datamodel-code-generator is a tool used to automatically create Python code from data definitions like OpenAPI or JSON schemas. A security flaw allows an attacker to provide a specially crafted data definition that, when processed, generates a malicious Python file. If a developer or system then runs or imports this generated file, the attacker can execute arbitrary code on the system, potentially leading to a full system takeover or data theft.

Technologies: [Koxudaxi Datamodel-Code-Generator](https://junglewise.ai/threats/technologies/datamodel-code-generator). Vendors: [Koxudaxi](https://junglewise.ai/threats/vendors/koxudaxi).

## Quick answers

**Is CVE-2026-63720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63720 being exploited in the wild.

**How severe is CVE-2026-63720?** High severity, with a CVSS score of 7.5, published 26 July 2026.

**Which products and versions are affected?** Koxudaxi Datamodel-Code-Generator < 0.70.0.

**Is there a fix for CVE-2026-63720?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63720?** Check whether you run Koxudaxi Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in datamodel-code-generator versions prior to 0.70.0 due to improper validation of the 'customBasePath' field in input schemas. An attacker can supply a malicious value containing embedded newlines and dot-free Python expressions, which the tool emits verbatim into a generated 'from ... import ...' statement. Because the tool fails to validate these identifiers, arbitrary Python code is executed when the resulting generated module is imported by a user or automated system. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and was addressed in version 0.70.0.

## Affected products

- koxudaxi datamodel-code-generator < 0.70.0

## Timeline

- 2026-07-26: advisory
- 2026-07-26: disclosed

## References

- [https://github.com/koxudaxi/datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator)
- [https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5](https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5)
- [https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field](https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field)

## Related threats

- [koxudaxi datamodel-code-generator code injection in generated imports](https://junglewise.ai/threats/cve-2026-55415-koxudaxi-datamodel-code-generator-code-injection-in-generated)
- [koxudaxi datamodel-code-generator credential leak in cross-origin redirects](https://junglewise.ai/threats/cve-2026-55403-koxudaxi-datamodel-code-generator-credential-leak-in-cross-origin)
- [koxudaxi datamodel-code-generator SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-55391-koxudaxi-datamodel-code-generator-ssrf-via-dns-rebinding)
- [koxudaxi datamodel-code-generator path traversal in XML Schema parsing](https://junglewise.ai/threats/cve-2026-55390-koxudaxi-datamodel-code-generator-path-traversal-in-xml-schema)
- [koxudaxi datamodel-code-generator local file read via JSON Schema ref](https://junglewise.ai/threats/cve-2026-55389-koxudaxi-datamodel-code-generator-local-file-read-via-json-schema)