PT-2026-65610 · Pypi · Datamodel-Code-Generator

CVE-2026-54655 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1

Description Insufficient validation of x-python-type values in the get python type override() function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JSON Schema content to execute arbitrary Python code. When a schema author uses the x-python-type extension to override a generated Python type, the value is inserted into the generated field annotations without adequate sanitization. An attacker can bypass the existing sanitization by placing a bracket [ early in the string, allowing them to embed arbitrary Python statements. This code is executed at class-definition time the moment the generated module is imported by a developer or a CI runner.

Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-54655

GHSA-M34R-V34R-RF9Q

Affected Products

Datamodel-Code-Generator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54655 · Security Note
• https://osv.dev/vulnerability/GHSA-m34r-v34r-rf9q · Vendor Advisory
• https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba · Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note