CyberRota Analysis
AI-GeneratedThe datamodel-code-generator tool, versions 0.11.6 to 0.64.0, is vulnerable to an attacker-controlled import manipulation that can lead to arbitrary code execution when the generated models are imported. This vulnerability arises from improper handling of custom schema extensions, allowing attackers to inject newline characters that break out of import statements. Organizations using affected versions of this tool should prioritize updating to version 0.64.0 or later to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)