Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 19.8%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-55415


Contact Us

Shodan ® - All rights reserved