High severityNVD Advisory· Published Jul 28, 2026· Updated Jul 29, 2026
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVE-2026-55415
Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
datamodel-code-generatorPyPI | >= 0.11.6, < 0.64.0 | 0.64.0 |
Affected products
2- Range: 0.11.6 - 0.64.0
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-5578-w22f-pfx9ghsaADVISORY
- github.com/koxudaxi/datamodel-code-generator/commit/577d49569c2254c371a97e495020ae2238a73b84ghsax_refsource_MISCWEB
- github.com/koxudaxi/datamodel-code-generator/releases/tag/0.64.0ghsax_refsource_MISCWEB
- github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-5578-w22f-pfx9ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.