1 matches found
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...
7.5CVSS6.8AI score
SaveExploits0References4Affected Software1
20