CVE-2026-63720: datamodel-code-generator RCE Vulnerability

CVE-2026-63720 Overview

CVE-2026-63720 is a code injection vulnerability [CWE-94] in datamodel-code-generator versions prior to 0.70.0. The library generates Python data models from JSON, OpenAPI, and JSON Schema definitions. Attackers who control input schemas can achieve remote code execution by supplying a malicious customBasePath value that contains embedded newlines and a dot-free Python expression. The crafted value is written verbatim into a generated from ... import ... statement without identifier validation. Arbitrary Python code then executes when the generated module is imported by downstream tooling or applications.

Critical Impact
Attackers controlling a schema input can execute arbitrary Python code in any process that imports the generated module, compromising build pipelines, code generation services, and developer workstations.

Affected Products

datamodel-code-generator versions prior to 0.70.0
Python projects consuming untrusted JSON Schema, OpenAPI, or JSON inputs through this library
CI/CD pipelines and code generation services that invoke the tool on user-supplied schemas

Discovery Timeline

2026-07-26 - CVE-2026-63720 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-63720

Vulnerability Analysis

The vulnerability resides in the JSON Schema parser in src/datamodel_code_generator/parser/jsonschema.py. When a schema declares a customBasePath field, the parser emits that value directly into a Python from <path> import <name> statement in the generated module. The parser performs no validation that customBasePath is a valid dotted Python import path. It also does not restrict newline characters or arbitrary expressions embedded in the value.

Because Python parses the entire generated file at import time, any injected statements execute in the importing process. This produces a classic code injection primitive [CWE-94] triggered indirectly through code generation. Exploitation requires the attacker to influence the schema input and requires a victim to import the resulting module, which explains the network attack vector combined with user interaction.

Root Cause

The root cause is missing input validation on the custom_base_path field of the schema model. The parser treats schema-controlled strings as trusted Python source fragments. A dot-free expression bypasses any dotted-path assumption, and embedded newlines allow the attacker to append fully formed Python statements to the generated file.

Attack Vector

An attacker supplies a JSON Schema whose customBasePath contains an expression such as evil\nimport os; os.system('...'). Running datamodel-codegen against this schema produces a Python module that includes the attacker-controlled lines outside the intended from ... import ... context. Importing the generated module executes the injected code with the privileges of the importing process.

python

# Security patch in src/datamodel_code_generator/parser/jsonschema.py
# Source: https://github.com/koxudaxi/datamodel-code-generator/commit/545a96c5

         # this condition expects empty dict
         return None if values == {} else values
 
+    @field_validator("custom_base_path", mode="before")
+    def validate_custom_base_path(cls, value: Any) -> Any:  # noqa: N805
+        """Validate schema-controlled custom base class import paths."""
+        match value:
+            case None:
+                return None
+            case list():
+                for item in value:
+                    _validate_schema_python_import_path(item, "customBasePath")
+            case _:
+                _validate_schema_python_import_path(value, "customBasePath")
+        return value
+
     @cached_property
     def has_default(self) -> bool:
         """Check if the schema has a default value or default factory."""

The patch adds a Pydantic field_validator that runs _validate_schema_python_import_path against every customBasePath value, rejecting anything that is not a valid Python dotted import path.

Detection Methods for CVE-2026-63720

Indicators of Compromise

JSON, OpenAPI, or JSON Schema files containing a customBasePath field with newline characters, semicolons, or non-identifier characters
Generated Python modules that contain statements outside the expected from ... import ... structure at the top of the file
Unexpected outbound network connections or child processes spawned by datamodel-codegen runs or by processes that import generated models

Detection Strategies

Scan schema repositories and CI artifacts for customBasePath values that fail a strict dotted-identifier regex such as ^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$.
Diff generated model files against a clean baseline and alert on any injected imports, function calls, or shell invocations.
Review software composition analysis (SCA) inventories for datamodel-code-generator versions earlier than 0.70.0.

Monitoring Recommendations

Monitor build agents and code generation workers for unexpected process execution during or after datamodel-codegen runs.
Log and audit all schema ingestion from external or untrusted sources, including third-party OpenAPI specifications.
Alert on writes to Python site-packages, credential stores, or SSH configuration by processes spawned from code generation workflows.

How to Mitigate CVE-2026-63720

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.70.0 or later across all developer, CI, and production environments.
Treat every JSON Schema, OpenAPI document, and JSON payload processed by the tool as untrusted input until upgrade is complete.
Revoke and rotate any credentials that were accessible to build agents or workstations that processed untrusted schemas with a vulnerable version.

Patch Information

The fix is committed in koxudaxi/datamodel-code-generator commit 545a96c5 and shipped in release 0.70.0. It introduces a field_validator on custom_base_path that enforces a valid Python dotted import path via _validate_schema_python_import_path. See the VulnCheck Security Advisory for full advisory details and the project repository for release notes.

Workarounds

Strip or reject the customBasePath field from all incoming schemas before invoking the code generator.
Validate any retained customBasePath value against a strict dotted-identifier allowlist and reject values containing newline, whitespace, or punctuation characters.
Run datamodel-codegen inside a sandboxed, non-privileged container with no network egress and no access to secrets when processing third-party schemas.

bash

# Configuration example: pre-validate customBasePath before code generation
python - <<'PY'
import json, re, sys
SCHEMA = sys.argv[1]
IDENT = re.compile(r'^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$')
with open(SCHEMA) as f:
    data = json.load(f)
values = data.get('customBasePath')
if values is not None:
    items = values if isinstance(values, list) else [values]
    for v in items:
        if not isinstance(v, str) or not IDENT.match(v):
            sys.exit(f'Rejecting unsafe customBasePath: {v!r}')
print('customBasePath validation passed')
PY