CVE-2026-55415
Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
How to fix
- koxudaxi datamodel-code-generator0.64.0 or later
- datamodel-code-generator0.64.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| koxudaxi datamodel-code-generator | 0.11.6 ≤ v < 0.64.0 | 0.64.0 |
| datamodel-code-generatorPyPI | 0.11.6 ≤ v < 0.64.0 | 0.64.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.