CVE-2026-54655

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Desde la versión 0.51.0 hasta la 0.60.2, los valores x-python-type analizados por src/datamodel_code_generator/parser/jsonschema.py en _get_python_type_override se insertan en las anotaciones de campo generadas sin validación suficiente, lo que permite que el contenido de esquema JSON controlado por el atacante ejecute código Python cuando se importa el módulo generado. Este problema está corregido en la versión 0.60.2.

Information

Published : 2026-07-28 22:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54655

Mitre link : CVE-2026-54655

CVE.ORG link : CVE-2026-54655

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-54655", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54655", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T12:46:44.431126Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"status": "affected", "version": ">= 0.51.0, < 0.60.2"}]}]}], "published": "2026-07-28T22:17:40.360", "references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba", "source": "security-advisories@github.com"}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "source": "security-advisories@github.com"}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2."}, {"lang": "es", "value": "datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Desde la versi\u00f3n 0.51.0 hasta la 0.60.2, los valores x-python-type analizados por src/datamodel_code_generator/parser/jsonschema.py en _get_python_type_override se insertan en las anotaciones de campo generadas sin validaci\u00f3n suficiente, lo que permite que el contenido de esquema JSON controlado por el atacante ejecute c\u00f3digo Python cuando se importa el m\u00f3dulo generado. Este problema est\u00e1 corregido en la versi\u00f3n 0.60.2."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}