CVE-2026-54655 Details
Description
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.
A code execution vulnerability has been identified in datamodel-code-generator versions 0.51.0 prior to 0.60.2. The issue arises from the improper validation of x-python-type values in JSON Schema, which are parsed and inserted into generated Python data models. This flaw allows an attacker to execute arbitrary Python code when the generated module is imported. The vulnerability is present in the JSON Schema parsing component of the datamodel-code-generator.
Users can upgrade to datamodel-code-generator version 0.60.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba | [email protected] | Source CodeVendor |
| https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 | [email protected] | Release NotesVendor |
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi datamodel-code-generator | >= 0.51.0, <= 0.60.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |