Listen to this Post
The vulnerability resides in the `datamodel-code-generator` Python package, a widely used tool that generates Pydantic models, dataclasses, TypedDict, and msgspec.Struct from various schema formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Affected versions range from 0.11.6 up to (but not including) 0.64.0.
The core issue lies in how the generator handles two specific schema extensions: `x-python-import` and customTypePath. These extensions are intended to allow users to specify custom Python types or import paths within the schema. However, the generator fails to properly sanitize or validate the values provided in these fields.
When the parser encounters these extensions in src/datamodel_code_generator/parser/jsonschema.py, it passes the attacker-controlled values directly to `Import.from_full_path` and subsequently to `Imports.create_line` in src/datamodel_code_generator/imports.py. The `from_full_path` method uses a naive `class_path.split(“.”)` to parse the input, preserving every other character including newlines (\n). The `create_line` method then renders the import statement verbatim using an f-string.
This allows an attacker to inject a newline character into the extension value, breaking out of the `from … import …` statement. For example, if the attacker sets the `name` field of `x-python-import` to "getcwd\nprint(open('/etc/passwd'), file=open('/tmp/loot','w'))", the full path becomes "os.getcwd\nprint(...)". The `split(“.”)` method processes this as `from_=”os”` and import_="getcwd\nprint(...)", resulting in generated code like:
from os import getcwd
print(open('/etc/passwd'), file=open('/tmp/loot','w'))
The injected statement executes immediately when the generated model is imported, with the same privileges as the importing process. This creates an unauthenticated, schema-driven Remote Code Execution (RCE) vulnerability affecting any consumer who generates and imports models from untrusted schemas.
The issue was fixed in version 0.64.0 by introducing the `_validate_schema_python_import_path` helper function, which uses `_validate_dotted_python_identifier_path` to strictly check that each segment is a valid Python identifier, rejecting any input containing newlines or non-identifier characters.
DailyCVE Form:
Platform: ……. Python/PyPI
Version: …….. 0.11.6-0.63.9
Vulnerability :…… Code Injection
Severity: ……. High (7.5 CVSS)
date: ………. 2026-07-28
Prediction: …… 2026-08-06
What Undercode Say:
Analytics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- CVSS Base Score: 7.5
- EPSS: Not yet available
Identify vulnerable version pip show datamodel-code-generator | grep Version Check if version is between 0.11.6 and 0.64.0 python -c "import datamodel_code_generator; print(datamodel_code_generator.<strong>version</strong>)" Generate models from a malicious schema (PoC) cat > malicious_schema.json << EOF { "type": "object", "properties": { "test": { "type": "string", "x-python-import": { "module": "os", "name": "getcwd\nprint(open('/etc/passwd'), file=open('/tmp/loot','w'))" } } } } EOF datamodel-codegen --input malicious_schema.json --output model.py Importing the generated model triggers the payload python -c "import model"
Exploit:
An attacker crafts a malicious OpenAPI or JSON Schema containing the `x-python-import` or `customTypePath` extension with a payload that includes a newline character followed by arbitrary Python code. The payload must not contain a dot (.) to bypass the `split(“.”)` constraint, making attribute-free builtins like print, open, exec, or `__import__` ideal candidates. When a victim generates Python models from this schema using the vulnerable tool and subsequently imports the generated module, the injected code executes with the victim’s process privileges, enabling file reads, data exfiltration, or full remote code execution.
Protection:
- Upgrade to datamodel-code-generator version 0.64.0 or later immediately.
- If upgrading is not possible, avoid running the tool on untrusted or third-party schemas.
- Implement a manual review process for all schema files before generation, checking for the presence of `x-python-import` and `customTypePath` extensions.
- Use static analysis tools to scan generated Python code for anomalous import statements or unexpected module-level code execution.
Impact:
Successful exploitation allows an attacker to execute arbitrary Python code on the machine that imports the generated model. This can lead to unauthorized access to sensitive files (e.g., /etc/passwd), data theft, privilege escalation, lateral movement within CI/CD pipelines, and complete compromise of multi-tenant code generation services. The vulnerability is particularly dangerous in automated environments where schemas are fetched from external sources without thorough validation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
