CVE-2026-63720

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

7.5 HighPublic exploitFix available

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.74%Up 0.3 points since Jul 26, 2026

What each source reports

CVE List Score used 7.5

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

Record: CVE-2026-63720
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2026-49050 7.5

Record: EUVD-2026-49050
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7x49-hhjc-29rg 7.5

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that...

Record: GHSA-7x49-hhjc-29rg
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-63720
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 7.5

datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

Record: CVE-2026-63720
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-94
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11538-1 No score

python313-datamodel-code-generator-0.72.3-1.1 on GA media

These are all security issues fixed in the python313-datamodel-code-generator-0.72.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11538-1
Updated: 2026-11-02

Affected products

koxudaxi datamodel-code-generator

Affected packages

Affected packages
Package	Affected	Fixed
`python-datamodel-code-generator` openSUSE:Tumbleweed	before 0.72.3-1.1	0.72.3-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	rahulreddykarne/CVE-2026-63720-datamodel-code-generator	2026-08-03

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63720 is a high vulnerability (CVSS 7.5) in Koxudaxi Datamodel-code-generator, published July 26, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in python-datamodel-code-generator 0.72.3-1.1.

References

Show 5 moreShow less