CVE-2026-63720

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.70.0

Description A code injection flaw exists where attackers controlling input schemas can achieve remote code execution. By providing a malicious customBasePath value containing embedded newlines and a dot-free Python expression, the value is inserted directly into a generated 'from ... import ...' statement without identifier validation. This results in the execution of arbitrary Python code when the generated module is imported.

Recommendations Update datamodel-code-generator to version 0.70.0 or later.