datamodel-code-generator, used to generate Pydantic v2 models and related structures from various schema formats, contains a code injection flaw. Attackers can embed malicious import parameters via the schema extensions x-python-import or customTypePath. Those extensions are passed to Import.from_full_path and Imports.create_line, where a newline in the value can break out of the generated import statement and execute arbitrary Python code when the resulting module is imported. The flaw permits remote code execution.

The koxudaxi datamodel-code-generator is vulnerable in all releases starting from 0.11.6 up to, but not including, 0.64.0. Any environment that runs the generator with any of these versions on input containing untrusted x‑python‑import or customTypePath schema extensions and then imports the generated modules is affected. The issue was fixed in release 0.64.0.

The CVSS score of 7.5 marks the flaw as high severity, while an EPSS score below 1% indicates a low but non‑zero likelihood of exploitation. It is not listed in CISA KEV. Exploitation requires an attacker to supply a malicious schema to the generator, which writes the generated file; execution is only achieved when the file is imported or run by the downstream application. Based on the description, the attack vector is inferred to be local to the code generation process, but the impact of the executed payload can be arbitrary code run with the privileges of the importing process.