CVE-2026-63720

Code injection via a crafted customBasePath allows remote code execution.

• CVSS 7.5
• CWE-94
• Input Validation and Sanitization
• Local

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from … import …' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

CVE

CVE-2026-63720

CWE

CWE-94

CVSS base score

7.5

Published

2026-07-26

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

datamodel-co

Fixed by upgrading

Yes

Solution

Upgrade `datamodel-code-generator` to version 0.70.0 or later.

def generate_import_statement(custom_base_path: str, class_name: str) -> str:
    # VULNERABLE: customBasePath emitted verbatim, newlines allow code injection
    return f"from {custom_base_path} import {class_name}"


def render_module(schema: dict) -> str:
    custom_base_path = schema.get('customBasePath', 'default.base.path')
    return generate_import_statement(custom_base_path, 'BaseModel')

def generate_import_statement(custom_base_path: str, class_name: str) -> str:
    # FIX: require a dot-separated sequence of valid Python identifiers
    parts = custom_base_path.split('.')
    if not parts or not all(part.isidentifier() for part in parts):
        raise ValueError(f"Invalid module path: '{custom_base_path}'")
    return f"from {custom_base_path} import {class_name}"


def render_module(schema: dict) -> str:
    custom_base_path = schema.get('customBasePath', 'default.base.path')
    return generate_import_statement(custom_base_path, 'BaseModel')

a\nexec('import os; os.system("touch /tmp/pwned")') #

@misc{vaitp:cve202663720,
  title        = {{Code injection via a crafted customBasePath allows remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-63720},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-63720/}}
}