The datamodel-code-generator tool, used to generate Pydantic v2 models and other data structures from various schema formats, improperly controls code generation when processing x-python-import or customTypePath schema extensions. Specifically, from versions 0.11.6 until 0.64.0, these extensions can inject newline characters that break out of import statements in the generated Python code, enabling execution of arbitrary code upon import. This is a CWE-94 (Improper Control of Generation of Code) vulnerability that can lead to high impact including confidentiality, integrity, and availability compromise. The issue is resolved in version 0.64.0.

Successful exploitation allows an attacker to execute arbitrary Python code in the context of the environment importing the generated model, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 7.5 (High), reflecting network attack vector, high impact, but requiring user interaction and high attack complexity.

Upgrade datamodel-code-generator to version 0.64.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid importing generated models from untrusted schema sources that could contain malicious x-python-import or customTypePath extensions.