PT-2026-65617 · Pypi · Datamodel-Code-Generator
CVE-2026-55415
·
Published
2026-07-28
·
Updated
2026-07-28
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
datamodel-code-generator versions 0.11.6 through 0.63.0
Description
A flaw in the handling of schema extensions allows for remote code execution on the machine that imports the generated model. When processing a malicious OpenAPI or JSON Schema, the software fails to sanitize the
x-python-import and customTypePath extensions. An attacker can embed a newline character within these values to break out of the generated from ... import ... statement and inject arbitrary Python code at the module scope.This occurs because the
Import.from full path() function only splits the input string by dots and does not verify if the resulting segments are valid Python identifiers. The Imports.create line() function then renders this unsanitized input verbatim into the output file. Consequently, any user or automated system (such as CI pipelines or multi-tenant services) that generates a model from an untrusted schema and subsequently imports that model will execute the injected code with the privileges of the importing process.Recommendations
Update datamodel-code-generator to version 0.64.0.
As a temporary mitigation, avoid using the
x-python-import and customTypePath extensions when processing schemas from untrusted or third-party sources.Fix
Eval Injection
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Datamodel-Code-Generator