CVE-2026-54656: CWE-94: Improper Control of Generation of Code ('Code Injection') in koxudaxi datamodel-code-generator
CVE-2026-54656 is a high-severity code injection vulnerability in koxudaxi's datamodel-code-generator affecting versions from 0.52.1 up to but not including 0.60.2. The tool generates Pydantic v2 models and other data models from various schema formats. The vulnerability arises because the software interpolates validators from the --extra-template-data option into @field_validator decorators without safe validation, allowing arbitrary Python code execution when the generated model is imported. This issue is fixed in version 0.60.2.
AI Analysis
Technical Summary
The datamodel-code-generator tool versions >=0.52.1 and <0.60.2 improperly handle code generation by interpolating user-supplied validator code from the --extra-template-data parameter directly into Pydantic v2 model validators without sanitization. This unsafe interpolation occurs in src/datamodel_code_generator/model/pydantic_v2/base_model.py via the _process_validators function, leading to potential arbitrary Python code execution upon importing the generated model. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code). The issue is resolved in version 0.60.2.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Python code in the context of the environment importing the generated Pydantic v2 model. This can lead to full compromise of the host system, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.8 (high), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in datamodel-code-generator version 0.60.2. Users should upgrade to version 0.60.2 or later to remediate this vulnerability. Until upgrading, avoid importing generated models from untrusted or unsanitized --extra-template-data inputs.
CVE-2026-54656: CWE-94: Improper Control of Generation of Code ('Code Injection') in koxudaxi datamodel-code-generator
Description
CVE-2026-54656 is a high-severity code injection vulnerability in koxudaxi's datamodel-code-generator affecting versions from 0.52.1 up to but not including 0.60.2. The tool generates Pydantic v2 models and other data models from various schema formats. The vulnerability arises because the software interpolates validators from the --extra-template-data option into @field_validator decorators without safe validation, allowing arbitrary Python code execution when the generated model is imported. This issue is fixed in version 0.60.2.
CVSS v3.1
Score 7.8high
Affected software
koxudaxi
datamodel-code-generator
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The datamodel-code-generator tool versions >=0.52.1 and <0.60.2 improperly handle code generation by interpolating user-supplied validator code from the --extra-template-data parameter directly into Pydantic v2 model validators without sanitization. This unsafe interpolation occurs in src/datamodel_code_generator/model/pydantic_v2/base_model.py via the _process_validators function, leading to potential arbitrary Python code execution upon importing the generated model. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code). The issue is resolved in version 0.60.2.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Python code in the context of the environment importing the generated Pydantic v2 model. This can lead to full compromise of the host system, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.8 (high), reflecting local attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in datamodel-code-generator version 0.60.2. Users should upgrade to version 0.60.2 or later to remediate this vulnerability. Until upgrading, avoid importing generated models from untrusted or unsanitized --extra-template-data inputs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T20:16:46.199Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6924a99c2644c7f842566d
Added to database: 07/28/2026, 21:52:41 UTC
Last enriched: 08/05/2026, 15:03:12 UTC
Last updated: 09/12/2026, 22:01:34 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.