The koxudaxi datamodel-code-generator library is susceptible to a code injection vulnerability that could result in arbitrary code execution during model generation.

This vulnerability involves improper control of code generation (CWE-94) and improper neutralization of special elements in a template engine (CWE-1336). An unauthenticated attacker can provide malicious input that, when processed by the generator, results in the execution of arbitrary code.

Exploitation of this vulnerability allows for remote code execution, which may lead to complete system compromise, data exfiltration, or lateral movement within the network. With a CVSS score of 8.8, this flaw is highly dangerous for any development pipeline that automatically processes external schemas using this library.

Immediate Action: Update the datamodel-code-generator library to version 0.60.2 or later immediately.

Proactive Monitoring: Audit CI/CD pipelines and automated workflows that utilize this library to identify if untrusted input is being passed to the generator.

Compensating Controls: Run the generation process in a sandboxed or isolated environment with minimal privileges to contain any potential malicious code execution.

Public Exploit Available: No confirmed public exploit available.

Due to the severity of code injection vulnerabilities, organizations using this library must update to the patched version as soon as possible. It is also recommended to review all input sources for automated generation tasks to ensure they are strictly validated.