The datamodel-code-generator tool generates Python data models from schema definitions. Between versions 0.51.0 and before 0.60.2, the x-python-type values parsed by the _get_python_type_override function in src/datamodel_code_generator/parser/jsonschema.py are inserted directly into generated field annotations without adequate validation. This allows an attacker who controls JSON Schema input to inject and execute arbitrary Python code upon import of the generated module. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code).

Successful exploitation allows an attacker with the ability to supply JSON Schema input to execute arbitrary Python code in the context of the user importing the generated module. This can lead to full compromise of the environment where the code is run, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8 (High), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade datamodel-code-generator to version 0.60.2 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid importing generated modules from untrusted or attacker-controlled JSON Schema inputs.