CVE-2026-63720
Received Received - Intake

Code Injection in datamodel-code-generator Prior to 0.70.0

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: VulnCheck

Description
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-63720
EUVD
EUVD-2026-49050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
koudai_aono datamodel-code-generator to 0.70.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63720 is a code injection vulnerability in datamodel-code-generator versions before 0.70.0. Attackers who control input schemas can execute arbitrary Python code remotely by injecting a malicious customBasePath value containing newlines and a dot-free Python expression. This value is inserted directly into a generated 'from ... import ...' statement without validation, allowing code execution when the module is imported.

Detection Guidance

Check if datamodel-code-generator versions prior to 0.70.0 are installed using pip list or pip show datamodel-code-generator. Inspect generated Python files for suspicious import statements containing newlines or unusual Python expressions in customBasePath values.

Impact Analysis

If you use datamodel-code-generator versions prior to 0.70.0, attackers could exploit this flaw to run arbitrary code on your system by providing a specially crafted schema. This could lead to data breaches, system compromise, or unauthorized access depending on the context in which the generated code is used.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR (data protection), HIPAA (healthcare data), or other regulations, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.70.0 or later immediately. Review and validate all input schemas to ensure customBasePath values are safe and properly formatted. Remove any untrusted generated Python modules until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart