VulnSocial

CVE-2026-63720Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-26: 2Technical Details · 2026-07-26: 207-26
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • ROOTCAUSE@rootcausehq
    Disclosure

    A malicious input schema reaches RCE in datamodel-code-generator before 0.70.0: a customBasePath with embedded newlines and a dot-free Python expression is executed. Generating models from schemas you did not write is the path. CVSS 7.5. https://nvd.nist.gov/vuln/detail/CVE-2026-63720 #supplychain https://t.co/TgAGNN8pZy

    Post summary

    The post discloses CVE-2026-63720, detailing an RCE vector involving customBasePath and providing a CVSS score, without offering a PoC, exploit code, or patch information.

    12042414
    566 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-63720 Remote Code Execution in datamodel-code-generator Prior to Version 0.70.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-63720

    Post summary

    The post merely announces the RCE vulnerability in datamodel-code-generator before version 0.70.0, offering no further technical details beyond the type of flaw.

    00000152
    4.1K followersView on X

Explore more

Back to dashboard