PT-2026-65609 · Pypi · Datamodel-Code-Generator

CVE-2026-54653

·

Published

2026-07-28

·

Updated

2026-07-28

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.17.0 through 0.60.1
Description Code injection is possible when generating Python models from attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schemas. The issue occurs because the tool preserves the default factory key from the schema and interpolates its value verbatim as a raw Python expression into the generated Field(default factory=...) or field(default factory=...) calls. Since these assignments are evaluated during class definition, importing the generated module leads to arbitrary Python code execution in the consumer's process.
The vulnerability involves the following technical details:
  • Vulnerable Functions: JsonSchemaObject. init and get field extras in src/datamodel code generator/parser/jsonschema.py preserve the malicious input.
  • Vulnerable Variable: The default factory value is interpolated without validation or the use of repr() in the generated output.
This affects Pydantic v2, dataclass, and msgspec output model types. Using typing.TypedDict as the output model type is not affected as it does not render the vulnerable calls.
Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later.

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1336CWE-94

Related Identifiers

CVE-2026-54653
GHSA-386Q-5HP3-95M9

Affected Products

Datamodel-Code-Generator