CVE-2026-63720: Improper Control of Generation of Code ('Code Injection') in koxudaxi ...

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

The koxudaxi datamodel-code-generator before version 0.70.0 has a code injection vulnerability (CVE-2026-63720). The issue arises because the tool emits the customBasePath value verbatim into a 'from ... import ...' Python statement without validating that it is a proper identifier. If an attacker controls the input schema, they can craft a customBasePath containing embedded newlines and a dot-free Python expression, which results in arbitrary Python code execution when the generated module is imported. This vulnerability enables remote code execution triggered by malicious input schemas.

Successful exploitation allows an attacker who controls the input schema to execute arbitrary Python code remotely on the system running datamodel-code-generator. This can lead to full compromise of the environment where the code generation occurs, depending on the privileges of the process. The CVSS 4.0 score is 7.5 (high severity), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

No official patch or remediation is currently confirmed. Users should upgrade to version 0.70.0 or later once available, as the vulnerability affects versions prior to 0.70.0. Until a fix is released, avoid processing untrusted or attacker-controlled input schemas with datamodel-code-generator. Monitor the vendor advisory for updates on patches or official mitigations.

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

Machine-generated threat intelligence

The koxudaxi datamodel-code-generator before version 0.70.0 has a code injection vulnerability (CVE-2026-63720). The issue arises because the tool emits the customBasePath value verbatim into a 'from ... import ...' Python statement without validating that it is a proper identifier. If an attacker controls the input schema, they can craft a customBasePath containing embedded newlines and a dot-free Python expression, which results in arbitrary Python code execution when the generated module is imported. This vulnerability enables remote code execution triggered by malicious input schemas.

Successful exploitation allows an attacker who controls the input schema to execute arbitrary Python code remotely on the system running datamodel-code-generator. This can lead to full compromise of the environment where the code generation occurs, depending on the privileges of the process. The CVSS 4.0 score is 7.5 (high severity), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

No official patch or remediation is currently confirmed. Users should upgrade to version 0.70.0 or later once available, as the vulnerability affects versions prior to 0.70.0. Until a fix is released, avoid processing untrusted or attacker-controlled input schemas with datamodel-code-generator. Monitor the vendor advisory for updates on patches or official mitigations.

Threat ID: 6a6596189c2644c7f8e64e58

Added to database: 07/26/2026, 05:07:36 UTC

Last enriched: 07/26/2026, 05:22:00 UTC

Last updated: 07/27/2026, 12:11:37 UTC

Crowdsource mitigation strategies, intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Instant breach scanning across billions of leaked records. Free tier available.