CVE-2026-63720CWE-94code-injection

CVE-2026-63720

High · published July 26, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-26T09:16Z
References (5)
https://github.com/koxudaxi/datamodel-code-generator · [email protected]https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5 · [email protected]https://github.com/rahulreddykarne/CVE-2026-63720-datamodel-code-generator · [email protected]https://rahulkarne.com/#/cve/CVE-2026-63720 · [email protected]https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field · [email protected]
EPSS history
Timeline
  • 26 JUL 03:51Z
    datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
    cvelistv5