CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
Attackers can execute arbitrary Python code by injecting malicious expressions into the customBasePath field of input schemas processed by datamodel-code-generator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63720?
CVE-2026-63720 is a high-severity code injection vulnerability in koxudaxi datamodel-code-generator, published on 26 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Weakness: CWE-94
Which versions are affected by CVE-2026-63720?
How do I fix CVE-2026-63720?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-63720 being exploited?
There is no known exploitation of CVE-2026-63720 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-7x49-hhjc-29rg.