CVE-2026-127208
Deferred Deferred - Pending Action

Code Injection in datamodel-code-generator

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127208
EUVD
EUVD-2026-124714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datamodel-code-generator datamodel-code-generator From 0 (inc) to 0.84.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in datamodel-code-generator versions before 0.84.0. Attackers can craft malicious JSON Schemas with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position. This bypasses validation and allows embedding malicious Python expressions like __import__ calls within quoted string literals in generated source code. When Pydantic v2 evaluates these as ForwardRef via eval() during model_rebuild(), it results in arbitrary code execution on affected systems.

Detection Guidance

Check installed versions of datamodel-code-generator with pip show datamodel-code-generator or pip list. If version is below 0.84.0, the system is vulnerable. Inspect JSON schemas for x-python-type annotations containing suspicious patterns like __import__ or ast.Constant nodes in subscript slices.

Impact Analysis

The impact includes compromise of developer workstations, CI/CD pipelines, or applications that generate and import the affected models at runtime. Attackers could execute arbitrary code, potentially leading to data theft, system damage, or further network compromise depending on the environment where the vulnerable code runs.

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.84.0 or later immediately. Review and audit all JSON schemas for malicious x-python-type annotations before processing. Avoid using untrusted schemas in CI/CD pipelines or applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...