CyberRota Analysis
AI-GeneratedThe vulnerability exists in datamodel-code-generator versions prior to 0.70.0, allowing attackers to exploit input schemas to execute arbitrary Python code through a crafted customBasePath value. This code injection can lead to remote code execution, posing a significant risk to systems utilizing this tool. Organizations that rely on datamodel-code-generator for schema management should prioritize updating to the latest version to mitigate this threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.