CVE-2026-63720: Code Injection Vulnerability in datamodel-code-generator

A code injection vulnerability (CVE-2026-63720) has been identified in the datamodel-code-generator prior to version 0.70.0. This flaw allows attackers controlling input schemas to execute arbitrary Python code remotely by supplying a malicious customBasePath value. The vulnerability arises from the tool emitting this value verbatim into a 'from ... import ...' statement without proper identifier validation. Successful exploitation can lead to full environment compromise depending on process privileges. The CVSS score for this vulnerability is 7.5, indicating high severity. Currently, there is no confirmed patch or remediation available, and users are advised to avoid processing untrusted input schemas. Active exploitation has not been confirmed, but the potential impact is significant.

Key Points: • CVE-2026-63720 allows remote code execution via unvalidated input schemas. • The vulnerability affects datamodel-code-generator versions prior to 0.70.0. • No official patch is available; users should avoid untrusted input schemas.