The datamodel-code-generator tool versions >=0.17.0 and <0.60.2 improperly handle default_factory values derived from input schemas. Specifically, in src/datamodel_code_generator/parser/jsonschema.py, the JsonSchemaObject.init and get_field_extras methods preserve and emit these values directly into Field(default_factory=...) or field(default_factory=...) constructs. Because these values can be attacker-controlled, this leads to code injection allowing arbitrary Python expression execution upon importing the generated model. This vulnerability is tracked as CVE-2026-54653 and is fixed in version 0.60.2.

An attacker able to influence the input schema to datamodel-code-generator can inject arbitrary Python code that will execute when the generated model is imported. This can lead to full compromise of the environment running the generated code, including confidentiality, integrity, and availability impacts. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade datamodel-code-generator to version 0.60.2 or later, where this code injection vulnerability is fixed. Until upgrading, avoid processing untrusted or attacker-controlled input schemas with affected versions. Patch status is confirmed fixed in 0.60.2.