A code injection vulnerability in koxudaxi datamodel-code-generator prior to version 0.70.0 creates a risk of arbitrary code execution during the model generation process.

This vulnerability (CWE-94) involves improper neutralization of input used to generate code. An unauthenticated attacker can inject arbitrary code into the generated output by manipulating the customBasePath field in a schema, which is then executed when the model is processed.

The ability to inject arbitrary code into generated models can lead to full system compromise if the generated code is subsequently executed in a trusted environment. With a CVSS score of 7.5, this flaw poses a severe risk to development pipelines and downstream applications that rely on automatically generated data models.

Immediate Action: Update the datamodel-code-generator package to version 0.70.0 or later to incorporate the necessary validation fixes.

Proactive Monitoring: Audit generated code files for unexpected or unauthorized segments, particularly those originating from untrusted schema inputs.

Compensating Controls: Restrict access to the tool to authorized users only and implement strict input validation on any schema files before passing them to the generator.

Public Exploit Available: Unknown

Security teams should enforce an immediate update of the datamodel-code-generator dependency across all development environments. Failure to address this injection vector may allow attackers to compromise the integrity of the entire software supply chain.