Threats tagged 'ghsa-5hqf-87jh-5c5q'

datamodel-code-generator versions before 0.84.0 contain a code injection vulnerability. This flaw allows attackers to execute arbitrary code by providing a malicious JSON Schema with a specially crafted x-python-type annotation. The vulnerability arises because the validation functions parse_python_type_annotation and _python_type_expr_from_ast can be bypassed, enabling malicious Python expressions to be embedded and later evaluated by Pydantic v2 during model rebuilding. This can lead to arbitrary code execution on developer machines, CI/CD pipelines, or runtime environments that generate and import these models.