# Koxudaxi vulnerabilities Source: https://junglewise.ai/threats/vendors/koxudaxi Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/koxudaxi.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in Koxudaxi: 0 in the last 7 days and 3 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63471, was published on 3 November 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 3 - All time: 16 (3 critical, 0 exploited in the wild) ## About Koxudaxi A software developer focused on Python utilities and data modeling tools. ## Latest Koxudaxi vulnerabilities - [CVE-2026-63471: fastapi-code-generator code injection via unescaped OpenAPI path](https://junglewise.ai/threats/cve-2026-63471-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-63470: fastapi-code-generator code injection in docstring generation](https://junglewise.ai/threats/cve-2026-63470-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-63469: fastapi-code-generator code injection via unescaped response keys](https://junglewise.ai/threats/cve-2026-63469-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-55415: koxudaxi datamodel-code-generator code injection in generated imports](https://junglewise.ai/threats/cve-2026-55415-koxudaxi-datamodel-code-generator-code-injection-in-generated) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-55403: koxudaxi datamodel-code-generator credential leak in cross-origin redirects](https://junglewise.ai/threats/cve-2026-55403-koxudaxi-datamodel-code-generator-credential-leak-in-cross-origin) (low, CVSS 3.7, published 28 Jul 2026) - [CVE-2026-55391: koxudaxi datamodel-code-generator SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-55391-koxudaxi-datamodel-code-generator-ssrf-via-dns-rebinding) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-55390: koxudaxi datamodel-code-generator path traversal in XML Schema parsing](https://junglewise.ai/threats/cve-2026-55390-koxudaxi-datamodel-code-generator-path-traversal-in-xml-schema) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-55389: koxudaxi datamodel-code-generator local file read via JSON Schema ref](https://junglewise.ai/threats/cve-2026-55389-koxudaxi-datamodel-code-generator-local-file-read-via-json-schema) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-54691: koxudaxi datamodel-code-generator SSRF in remote schema fetching](https://junglewise.ai/threats/cve-2026-54691-koxudaxi-datamodel-code-generator-ssrf-in-remote-schema-fetching) (high, CVSS 8.2, published 28 Jul 2026) - [CVE-2026-54690: koxudaxi datamodel-code-generator SSRF via JSON Schema $ref](https://junglewise.ai/threats/cve-2026-54690-koxudaxi-datamodel-code-generator-ssrf-via-json-schema-ref) (high, CVSS 8.2, published 28 Jul 2026) - [CVE-2026-54656: koxudaxi datamodel-code-generator code injection in Pydantic v2 validators](https://junglewise.ai/threats/cve-2026-54656-koxudaxi-datamodel-code-generator-code-injection-in-pydantic-v2) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54655: koxudaxi datamodel-code-generator code injection via x-python-type extension](https://junglewise.ai/threats/cve-2026-54655-koxudaxi-datamodel-code-generator-code-injection-via-x-python) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54654: koxudaxi datamodel-code-generator code injection in --extra-template-data](https://junglewise.ai/threats/cve-2026-54654-koxudaxi-datamodel-code-generator-code-injection-in-extra) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54653: koxudaxi datamodel-code-generator code injection via default_factory field](https://junglewise.ai/threats/cve-2026-54653-koxudaxi-datamodel-code-generator-code-injection-via-default) (high, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-54621: koxudaxi datamodel-code-generator code injection in GraphQL Union templates](https://junglewise.ai/threats/cve-2026-54621-koxudaxi-datamodel-code-generator-code-injection-in-graphql-union) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-63720: koxudaxi datamodel-code-generator code injection in customBasePath](https://junglewise.ai/threats/cve-2026-63720-koxudaxi-datamodel-code-generator-code-injection-in) (high, CVSS 7.5, published 26 Jul 2026) ## Most severe Koxudaxi vulnerabilities - [CVE-2026-63470: fastapi-code-generator code injection in docstring generation](https://junglewise.ai/threats/cve-2026-63470-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-63471: fastapi-code-generator code injection via unescaped OpenAPI path](https://junglewise.ai/threats/cve-2026-63471-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-63469: fastapi-code-generator code injection via unescaped response keys](https://junglewise.ai/threats/cve-2026-63469-fastapi-code-generator-creates-fastapi-applications-from-openapi) (critical, CVSS 4, published 3 Nov 2026) - [CVE-2026-54653: koxudaxi datamodel-code-generator code injection via default_factory field](https://junglewise.ai/threats/cve-2026-54653-koxudaxi-datamodel-code-generator-code-injection-via-default) (high, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-54690: koxudaxi datamodel-code-generator SSRF via JSON Schema $ref](https://junglewise.ai/threats/cve-2026-54690-koxudaxi-datamodel-code-generator-ssrf-via-json-schema-ref) (high, CVSS 8.2, published 28 Jul 2026) - [CVE-2026-54691: koxudaxi datamodel-code-generator SSRF in remote schema fetching](https://junglewise.ai/threats/cve-2026-54691-koxudaxi-datamodel-code-generator-ssrf-in-remote-schema-fetching) (high, CVSS 8.2, published 28 Jul 2026) - [CVE-2026-54656: koxudaxi datamodel-code-generator code injection in Pydantic v2 validators](https://junglewise.ai/threats/cve-2026-54656-koxudaxi-datamodel-code-generator-code-injection-in-pydantic-v2) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54655: koxudaxi datamodel-code-generator code injection via x-python-type extension](https://junglewise.ai/threats/cve-2026-54655-koxudaxi-datamodel-code-generator-code-injection-via-x-python) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54654: koxudaxi datamodel-code-generator code injection in --extra-template-data](https://junglewise.ai/threats/cve-2026-54654-koxudaxi-datamodel-code-generator-code-injection-in-extra) (high, CVSS 7.8, published 28 Jul 2026) - [CVE-2026-54621: koxudaxi datamodel-code-generator code injection in GraphQL Union templates](https://junglewise.ai/threats/cve-2026-54621-koxudaxi-datamodel-code-generator-code-injection-in-graphql-union) (high, CVSS 7.8, published 28 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 3 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Koxudaxi technologies - [Koxudaxi Datamodel-Code-Generator](https://junglewise.ai/threats/technologies/datamodel-code-generator): 13 vulnerabilities - [Koxudaxi Fastapi-Code-Generator](https://junglewise.ai/threats/technologies/fastapi-code-generator): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Koxudaxi vulnerabilities", https://junglewise.ai/threats/vendors/koxudaxi, 11 November 2026.