https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:08:05 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63720 <p>datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated &#39;from ... import ...&#39; statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.</p> <p>datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated &#39;from ... import ...&#39; statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63720 https://vulnerability.circl.lu/vuln/ghsa-7x49-hhjc-29rg <p>datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated &#39;from ... import ...&#39; statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.</p> <p>datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated &#39;from ... import ...&#39; statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.</p> https://vulnerability.circl.lu/vuln/ghsa-7x49-hhjc-29rg https://vulnerability.circl.lu/vuln/opensuse-su-2026:11538-1 <p>python313-datamodel-code-generator-0.72.3-1.1 on GA media</p> <p>python313-datamodel-code-generator-0.72.3-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11538-1