CVE-2026-54656

Received Received - Intake

Code Execution via Template Data in datamodel-code-generator

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54656

Affected Vendors & Products

Vendor	Product	Version / Range
datamodel-code-generator	datamodel-code-generator	From 0.52.1 (inc) to 0.60.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The vulnerability in datamodel-code-generator allows unsafe interpolation of validators from --extra-template-data into @field_validator decorators in Pydantic v2 models. This can lead to arbitrary Python code execution when the generated model is imported, as the validators are not properly sanitized.

Detection Guidance

This vulnerability can be detected by checking the installed version of datamodel-code-generator. If the version is between 0.52.1 and 0.60.2, it is vulnerable. Run: pip show datamodel-code-generator to check the version.

Impact Analysis

If you use datamodel-code-generator versions between 0.52.1 and 0.60.2, an attacker could craft malicious input to execute arbitrary code when your generated Pydantic models are imported. This could lead to data breaches, system compromise, or unauthorized access depending on the application context.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.60.2 or later immediately. Use: pip install --upgrade datamodel-code-generator. Avoid using untrusted --extra-template-data inputs until patched.

Hi! I’m here to help you understand CVE-2026-54656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70