AIKIDO-2026-977044
datamodel-code-generator is vulnerable to Code Injection
75
High Risk
This Affects:
datamodel-code-generatorTL;DR
datamodel-code-generator writes the JSON Schema customBasePath field directly into a generated Python from ... import ... statement. A schema whose customBasePath value contains embedded newlines and a dot-free Python expression is emitted verbatim without identifier validation. When the generated module is later imported, the injected code executes on the machine running it, giving code execution to whoever controls the input schema. The fix adds a field validator that rejects unsafe customBasePath values before any output is written.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you generate models from an untrusted or externally influenced JSON Schema whose customBasePath value you do not control.
Background info
datamodel-code-generator is vulnerable to Code Injection in versions 0.0.1 - 0.69.0.
How to fix this
Upgrade the datamodel-code-generator library to the patch version.
Links
Other
github.com/koxudaxi/datamodel-code-generator
vulncheck.com/advisories/datamodel-code-generator-code-injection-via-unvalidated-custombasepath-schema-field
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant