CVE-2026-63720 in datamodel-code-generator
Summary
by MITRE • 07/26/2026
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the datamodel-code-generator library version 0.70.0 and earlier, representing a critical code injection flaw that enables remote code execution through carefully crafted input schemas. The vulnerability stems from insufficient validation of the customBasePath parameter during schema processing, allowing attackers to inject malicious Python expressions that are subsequently executed when the generated module is imported. The flaw specifically manifests when an attacker supplies a malicious customBasePath value containing embedded newlines and dot-free Python expressions that bypass normal identifier validation mechanisms.
The technical implementation of this vulnerability occurs during the code generation process where the library constructs import statements by directly incorporating user-supplied values into the generated Python code without proper sanitization or validation. When the generated module is subsequently imported by the application, the malicious code embedded within the customBasePath value executes with the privileges of the importing process, potentially allowing full system compromise. This type of vulnerability falls under CWE-94, which specifically addresses "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.006 for execution through Python.
The operational impact of this vulnerability extends beyond simple code injection to encompass complete system compromise when exploited by attackers. An attacker could potentially execute arbitrary commands on the target system, access sensitive data, or establish persistent backdoors through the execution of malicious Python code. The vulnerability is particularly dangerous because it can be triggered through legitimate input processing workflows where schemas are generated from user-provided data, making it difficult to detect and prevent without proper validation controls.
Mitigation strategies for this vulnerability require immediate patching of the datamodel-code-generator library to version 0.70.0 or later, which includes proper input validation and sanitization of customBasePath parameters. Organizations should implement strict input validation at all levels of their data processing pipelines, particularly when handling external schema definitions or user-supplied configuration values. Additional defensive measures include restricting the execution environment permissions for code generation processes, implementing network segmentation to limit exposure, and establishing runtime monitoring to detect anomalous code execution patterns. Security teams should also consider implementing static analysis tools that can identify potentially dangerous import statements in generated code and establish proper access controls to prevent unauthorized schema modifications. The vulnerability demonstrates the critical importance of input validation in code generation tools and highlights the need for comprehensive security testing of automated code generation processes against injection attacks.