Summary
A code injection flaw in datamodel-code-generator's import generation logic allows attacker-controlled schema extensions to inject arbitrary Python code into generated models.
When a malicious OpenAPI or JSON Schema uses crafted x-python-import or customTypePath values, the resulting model file can execute attacker-chosen code as soon as it is imported by an application.
A code injection flaw in datamodel-code-generator's import generation logic allows attacker-controlled schema extensions to inject arbitrary Python code into generated models.
When a malicious OpenAPI or JSON Schema uses crafted x-python-import or customTypePath values, the resulting model file can execute attacker-chosen code as soon as it is imported by an application.
Affected context
This vulnerability appears when applications use datamodel-code-generator to generate Python models from partially or fully untrusted specifications such as OpenAPI, JSON Schema, or related formats.
It specifically impacts workflows that:
- Accept external or third‑party schemas containing vendor extensions like x-python-import or customTypePath
- Automatically generate model code and check it into a codebase or load it at runtime
- Import the generated modules in a trusted execution environment (e.g., backend services, CLI tools, or tests)
In these contexts, the generator treats attacker-supplied extension values as safe input for constructing import statements, enabling injection of arbitrary Python code into the generated files.
This vulnerability appears when applications use datamodel-code-generator to generate Python models from partially or fully untrusted specifications such as OpenAPI, JSON Schema, or related formats.
It specifically impacts workflows that:
- Accept external or third‑party schemas containing vendor extensions like x-python-import or customTypePath
- Automatically generate model code and check it into a codebase or load it at runtime
- Import the generated modules in a trusted execution environment (e.g., backend services, CLI tools, or tests)
In these contexts, the generator treats attacker-supplied extension values as safe input for constructing import statements, enabling injection of arbitrary Python code into the generated files.
Exploit preconditions
- Attack surface: The schema ingestion interface used by datamodel-code-generator (e.g., file upload, repository sync, API-driven schema retrieval).
- Required access: Ability to influence or supply the OpenAPI/JSON Schema/other supported schemas processed by the generator, including control over x-python-import or customTypePath.
- Trigger point: Execution occurs when the application or developer imports the generated model module, running the injected Python code during module import.
- Why exploitation is possible: Import.from_full_path and Imports.create_line construct Python import lines directly from unvalidated schema extension values. A crafted value containing a newline can terminate the intended import statement and append arbitrary Python code, which is then written to the generated file and executed on import.
- Attack surface: The schema ingestion interface used by datamodel-code-generator (e.g., file upload, repository sync, API-driven schema retrieval).
- Required access: Ability to influence or supply the OpenAPI/JSON Schema/other supported schemas processed by the generator, including control over x-python-import or customTypePath.
- Trigger point: Execution occurs when the application or developer imports the generated model module, running the injected Python code during module import.
- Why exploitation is possible: Import.from_full_path and Imports.create_line construct Python import lines directly from unvalidated schema extension values. A crafted value containing a newline can terminate the intended import statement and append arbitrary Python code, which is then written to the generated file and executed on import.
Why this happens
The underlying flaw is an improper neutralization of special elements used in code generation, aligning with CWE-94 and CWE-95.
Instead of treating schema extension values as untrusted data to be sanitized and strictly parsed, the generator interpolates them into Python import statements without robust validation, escaping, or structural constraints.
This design allows control characters (like newline) and code fragments to break out of the import context, effectively turning data fields meant for configuration into executable source code inside the generated module.
The underlying flaw is an improper neutralization of special elements used in code generation, aligning with CWE-94 and CWE-95.
Instead of treating schema extension values as untrusted data to be sanitized and strictly parsed, the generator interpolates them into Python import statements without robust validation, escaping, or structural constraints.
This design allows control characters (like newline) and code fragments to break out of the import context, effectively turning data fields meant for configuration into executable source code inside the generated module.
Potential impact
- Execution of arbitrary Python code within the environment that imports the generated models
- Compromise of application servers that rely on generated models at build or runtime
- Theft or modification of sensitive data accessible to the importing process
- Lateral movement within CI/CD or developer environments where generation and import occur
- Introduction of persistent backdoors or supply-chain level compromise through poisoned generated code
- Execution of arbitrary Python code within the environment that imports the generated models
- Compromise of application servers that rely on generated models at build or runtime
- Theft or modification of sensitive data accessible to the importing process
- Lateral movement within CI/CD or developer environments where generation and import occur
- Introduction of persistent backdoors or supply-chain level compromise through poisoned generated code
General mitigation guidance
Effective mitigation focuses on treating schema-driven code generation as an untrusted boundary and constraining how configuration influences emitted source code.
Recommended patterns include:
- Enforcing strict validation and normalization of schema extensions (e.g., x-python-import, customTypePath) against a whitelist of allowed module paths and symbols.
- Avoiding direct string concatenation into import statements; instead, represent imports as structured objects validated for allowed characters and formats.
- Restricting or disabling code-like schema extensions entirely when consuming schemas from untrusted or third-party sources.
- Running code generation in isolated, least-privilege environments and reviewing generated files before they are imported in production code.
- Treating generated artifacts as potentially unsafe until they pass code review, static checks, or automated policy enforcement.
Effective mitigation focuses on treating schema-driven code generation as an untrusted boundary and constraining how configuration influences emitted source code.
Recommended patterns include:
- Enforcing strict validation and normalization of schema extensions (e.g., x-python-import, customTypePath) against a whitelist of allowed module paths and symbols.
- Avoiding direct string concatenation into import statements; instead, represent imports as structured objects validated for allowed characters and formats.
- Restricting or disabling code-like schema extensions entirely when consuming schemas from untrusted or third-party sources.
- Running code generation in isolated, least-privilege environments and reviewing generated files before they are imported in production code.
- Treating generated artifacts as potentially unsafe until they pass code review, static checks, or automated policy enforcement.
How teams detect issues like this
Detection strategies typically combine code review practices with automated analysis of both generator logic and generated outputs:
- Static analysis rules that flag dynamic or unvalidated construction of import statements or other executable code segments from external schema fields.
- Automated scanning of generated model files for suspicious patterns such as unexpected newlines inside import lines, semicolons, or inline executable statements where only imports are expected.
- Policy-based CI checks that verify schema extensions against an allowlist and reject builds if unknown or unsafe extensions (like arbitrary x-python-import values) are present.
- Repository-level monitoring for sudden changes in generated files that introduce new side effects, file I/O, network calls, or imports unrelated to data modeling.
- Use of automated review tools to focus reviewers on high-risk areas of code generation and generated artifacts.
Detection strategies typically combine code review practices with automated analysis of both generator logic and generated outputs:
- Static analysis rules that flag dynamic or unvalidated construction of import statements or other executable code segments from external schema fields.
- Automated scanning of generated model files for suspicious patterns such as unexpected newlines inside import lines, semicolons, or inline executable statements where only imports are expected.
- Policy-based CI checks that verify schema extensions against an allowlist and reject builds if unknown or unsafe extensions (like arbitrary x-python-import values) are present.
- Repository-level monitoring for sudden changes in generated files that introduce new side effects, file I/O, network calls, or imports unrelated to data modeling.
- Use of automated review tools to focus reviewers on high-risk areas of code generation and generated artifacts.
