CVE-2026-54655

Received Received - Intake

Code Injection in datamodel-code-generator via JSON Schema

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54655

Affected Vendors & Products

Vendor	Product	Version / Range
datamodel-code-generator	datamodel-code-generator	From 0.51.0 (inc) to 0.60.2 (inc)
datamodel-code-generator	datamodel-code-generator	0.60.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The vulnerability in datamodel-code-generator allows attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This occurs because x-python-type values are inserted into generated field annotations without proper validation between versions 0.51.0 and 0.60.2.

Detection Guidance

This vulnerability can be detected by checking the version of datamodel-code-generator installed on your system. If the version is between 0.51.0 and 0.60.2, it is vulnerable. Run the command: pip show datamodel-code-generator to check the installed version.

Impact Analysis

If you use a vulnerable version of datamodel-code-generator, an attacker could craft malicious JSON Schema input that executes arbitrary Python code when you import the generated module. This could lead to data breaches, system compromise, or unauthorized access to your environment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data exposure or loss. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Exploitation could result in regulatory penalties or legal consequences.

Mitigation Strategies

Update datamodel-code-generator to version 0.60.2 or later to address the vulnerability. Avoid using untrusted JSON Schema content in the tool until patched.

Hi! I’m here to help you understand CVE-2026-54655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70