CVE-2026-55415 koxudaxi CVE debrief

Who should care

Developers and administrators using datamodel-code-generator versions between 0.11.6 and 0.64.0 should be aware of this vulnerability and take immediate action to mitigate the risk. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and implement compensating controls for exposed systems while remediation is scheduled and verified. Security teams and vulnerability management teams should also be aware of this vulnerability and track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators and platform administrators should review relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and change management teams should also be aware of this vulnerability and confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Monitoring and incident response teams should check for suspicious import statements and generated models. Compensating controls, such as restricting access to sensitive data and systems, should be implemented to reduce the risk of exploitation. The datamodel-code-generator library is used in various products and components, and its vulnerability can have a significant impact on the security of these systems. Therefore, it is essential to address this vulnerability promptly and thoroughly.

Technical summary

The datamodel-code-generator library allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling, enabling newline injection and Python code execution when the generated model is imported. This issue affects datamodel-code-generator versions between 0.11.6 and 0.64.0, and it is fixed in version 0.64.0.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows attacker-controlled schema extensions to execute Python code when the generated model is imported.

Recommended defensive actions

• Inventory and assess affected systems using datamodel-code-generator versions between 0.11.6 and 0.64.0.
• Apply the patch by updating to datamodel-code-generator version 0.64.0 or later.
• Monitor for suspicious import statements and generated models.
• Implement compensating controls, such as restricting access to sensitive data and systems.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The datamodel-code-generator library allows attacker-controlled x-python-import or customTypePath schema extensions to execute Python code. Evidence from the NVD and CVE.org indicates that the issue is fixed in version 0.64.0. However, defenders should verify the affected scope, severity, and vendor guidance to ensure proper mitigation. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified.

Official resources