AIKIDO-2026-156743

TL;DR

datamodel-code-generator builds Python import statements from the x-python-import and customTypePath schema extensions without checking that the values are dotted Python identifiers. A crafted OpenAPI or JSON Schema can embed a newline in these extension values to break out of the generated from ... import ... line and inject an attacker-controlled statement at module scope. Importing the generated model then runs that Python code with the importing process's privileges, allowing arbitrary file read and remote code execution under default settings. The fix validates x-python-import and customTypePath values as dotted Python identifier paths before they reach the import generator.