PT-2026-65611 · Pypi · Datamodel-Code-Generator

CVE-2026-54656 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1

Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators() function in src/datamodel code generator/model/pydantic v2/base model.py interpolates validator field names and modes into @field validator decorators without safe validation or escaping. An attacker can provide a value containing a single quote to break out of the string literal and inject arbitrary Python expressions. Additionally, the Import.from full path() function can be exploited by inserting a semicolon into the function path to execute statements during module load. This allows for remote code execution (RCE) in the developer's interpreter or CI runner the moment the generated module is imported.

Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-54656

GHSA-8M8R-38JM-F355

Affected Products

Datamodel-Code-Generator

References · 6

• https://osv.dev/vulnerability/GHSA-8m8r-38jm-f355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54656 · Security Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355 · Note
• https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19 · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note