CVE-2026-54653
Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
How to fix
- koxudaxi datamodel-code-generator0.60.2 or later
- datamodel-code-generator0.60.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| koxudaxi datamodel-code-generator | 0.17.0 ≤ v < 0.60.2 | 0.60.2 |
| datamodel-code-generatorPyPI | 0.17.0 ≤ v < 0.60.2 | 0.60.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.