CVE-2026-54654

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

PT-2026-65611

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1 Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators function in src/datamodel co...

PT-2026-65609

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.17.0 through 0.60.1 Description Code injection is possible when generating Python models from attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schemas. The issue occurs because th...

PT-2026-65617

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.11.6 through 0.63.0 Description A flaw in the handling of schema extensions allows for remote code execution on the machine that imports the generated model. When processing a malicious OpenAPI or JSON Schem...

PT-2026-65606

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1 Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return r. The software renders this comment variable into Python commen...

PT-2026-65616

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description When fetching remote schemas, the software re-sends original request headers to redirect targets even if the redirect changes the origin host, port, or scheme. This occurs within th...

PT-2026-65613

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description The get body function in src/datamodel code generator/http.py fails to validate host or IP addresses when processing targets provided via the --url argument or through redirect...

PT-2026-65610

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1 Description Insufficient validation of x-python-type values in the get python type override function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JS...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

EUVD-2026-49050

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720

CVE-2026-63720 affects datamodel-code-generator prior to version 0.70.0. The issue is a code injection vulnerability where attackers who control input schemas can supply a malicious customBasePath containing embedded newlines and a dot-free Python expression, which is emitted into a generated fro...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

PT-2026-64795

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.70.0 Description A code injection flaw exists where attackers controlling input schemas can achieve remote code execution. By providing a malicious customBasePath value containing embedded newlines...

CVE-2026-20203

CVE-2026-20203 describes improper access control in Data Model Acceleration for Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127. A low-privilege user ...

CVE-2026-20203 Improper Access Control in Data Model Acceleration in Splunk Enterprise

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the admin or power Splunk roles, has write permission on...