GHSA-5578-w22f-pfx9

Summary

A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the from … import … line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote code execution against any consumer of the generated code (e.g. arbitrary file read,the PoC exfiltrates /etc/passwd). It survives the v0.61.0 security release that fixed the related x-python-type, default_factory, GraphQL-union-description, and validators sinks those fixes did not cover this sibling path.

Details

The sink is Import.from_full_path and Imports.create_line:

• src/datamodel_code_generator/imports.py:35 — from_full_path() only does class_path.split(".") and preserves every other character, including newlines:

  @classmethod
  @lru_cache
  def from_full_path(cls, class_path: str) -> Import:
      split_class_path: list[str] = class_path.split(".")
      return cls(import_=split_class_path[-1], from_=".".join(split_class_path[:-1]) or None)
  

• src/datamodel_code_generator/imports.py:64 — create_line() renders the result verbatim:

  def create_line(self, from_: str | None, imports: set[str]) -> str:
      if from_:
          return f"from {from_} import {', '.join(self._set_alias(from_, imports))}"
      return "\n".join(f"import {i}" for i in self._set_alias(from_, imports))
  

There is no check that the path segments are Python identifiers, contrast validators._validate_dotted_python_identifier_path, which the same v0.61.0 release added for the validators config, and types.is_python_type_annotation, added for x-python-type. The two extensions below were left unguarded....