CVE-2026-54655 | datamodel-code-generator generates Python data models from s… | CVSS 7.8 HIGH

Description

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

Metadata

CVE ID: CVE-2026-54655
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-15 20:16 UTC
Published: 2026-07-28 21:33 UTC
Last updated: 2026-07-28 21:33 UTC
Primary CWE: CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product: koxudaxi / datamodel-code-generator
Sources: cve.org · NVD

Severity & Metrics

7.8 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
koxudaxi	datamodel-code-generator	—	>= 0.51.0, < 0.60.2

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.8	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (3)

https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q
https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2