datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

The affected vendor is koxudaxi and the product is datamodel-code-generator. All releases before 0.70.0 are vulnerable. Any installation of the tool that can receive untrusted schema input may be impacted.

The vulnerability has a CVSS score of 7.5, indicating a high severity level. The EPSS score is less than 1%, suggesting a currently low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The attack requires an attacker to supply a crafted schema that the target system processes with datamodel-code-generator; once the generated module is imported, arbitrary Python code executes. The exploitation path is plausible in environments where generated code is automatically imported or executed, particularly in code-generation pipelines or build processes that incorporate the tool without validating the customBasePath field.