The koxudaxi datamodel-code-generator before version 0.70.0 has a code injection vulnerability (CVE-2026-63720). The issue arises because the tool emits the customBasePath value verbatim into a 'from ... import ...' Python statement without validating that it is a proper identifier. If an attacker controls the input schema, they can craft a customBasePath containing embedded newlines and a dot-free Python expression, which results in arbitrary Python code execution when the generated module is imported. This vulnerability enables remote code execution triggered by malicious input schemas.

Successful exploitation allows an attacker who controls the input schema to execute arbitrary Python code remotely on the system running datamodel-code-generator. This can lead to full compromise of the environment where the code generation occurs, depending on the privileges of the process. The CVSS 4.0 score is 7.5 (high severity), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

No official patch or remediation is currently confirmed. Users should upgrade to version 0.70.0 or later once available, as the vulnerability affects versions prior to 0.70.0. Until a fix is released, avoid processing untrusted or attacker-controlled input schemas with datamodel-code-generator. Monitor the vendor advisory for updates on patches or official mitigations.