Skip to content
CVE-2026-63720: Code Injection Vulnerability in datamodel-code-generator

CVE-2026-63720: Code Injection Vulnerability in datamodel-code-generator

First seen 27 Jul 2026, 04:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 28, 2026 at 03:51 UTC
  • •CVE-2026-63720 allows remote code execution via unvalidated input schemas.
  • •The vulnerability affects datamodel-code-generator versions prior to 0.70.0.
  • •No official patch is available; users should avoid untrusted input schemas.

A code injection vulnerability (CVE-2026-63720) has been identified in the datamodel-code-generator prior to version 0.70.0. This flaw allows attackers controlling input schemas to execute arbitrary Python code remotely by supplying a malicious customBasePath value. The vulnerability arises from the tool emitting this value verbatim into a 'from ... import ...' statement without proper identifier validation. Successful exploitation can lead to full environment compromise depending on process privileges. The CVSS score for this vulnerability is 7.5, indicating high severity. Currently, there is no confirmed patch or remediation available, and users are advised to avoid processing untrusted input schemas. Active exploitation has not been confirmed, but the potential impact is significant.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 55d ago How this analysis works

Timeline

2026-07-26
CVE-2026-63720 published
CVE-2026-63720 was published, detailing a code injection vulnerability in datamodel-code-generator.
Ismalicious
2026-07-27
Radar.Offseq reports on CVE-2026-63720
Radar.Offseq highlights the severity and exploitation potential of CVE-2026-63720, urging caution.
Radar.Offseq

More articles in this cluster (7)

Following this threat?

Track CVE-2026-63720 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4