Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-54653 high CVSS 8.8

Code Injection in datamodel-code-generator (CVE-2026-54653)

Summary

Code injection in datamodel-code-generator (CVE-2026-54653). Successful exploitation can lead to full system takeover. Exploitable via import. Mitigation: upgrade to 0.60.2 or later.

Original description

The description as published by the source.

Summary

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "default_factory" key, its value is interpolated verbatim — as a raw Python expression — into the generated Field(default_factory=...) / field(default_factory=...) call. Because this assignment is evaluated at class-definition time (i.e. on import of the generated module), an attacker who controls the schema controls a Python expression that runs in the consumer's process. No special CLI flags are required.

Details

The vulnerable chain spans the JSON-Schema-shaped parser and three sink locations (Pydantic v2, dataclass, msgspec):

Source — schema → extras:

  • src/datamodel_code_generator/parser/jsonschema.py:600-614 — DEFAULT_FIELD_KEYS includes the literal string "default_factory".
  • src/datamodel_code_generator/parser/jsonschema.py:457-459 — JsonSchemaObject.__init__ stores any non-standard key (including default_factory) in self.extras.
  • src/datamodel_code_generator/parser/jsonschema.py:797-812 — get_field_extras preserves default_factory through to the field model.

Sinks — extras → generated Python expression:

  1. src/datamodel_code_generator/model/pydantic_base.py:222-249:

    default_factory = data.pop("default_factory", None)
...
if default_factory is not None:
    field_arguments…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-54653 has been found in datamodel-code-generator.
Attackers can target a specific entry point like import over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.8/10.
What to do: upgrade datamodel-code-generator to 0.60.2 or later.
If unsure, ask your IT team or search "datamodel-code-generator CVE-2026-54653" on the vendor's site.

CVE-2026-54653 (datamodel-code-generator) — CWE-94 / CVSS v3 8.8
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: import / extras / DEFAULT_FIELD_KEYS / JsonSchemaObject.__init__
Patched: 0.60.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Arbitrary code execution (CWE-94) exists in datamodel-code-generator. Attackers reach the vulnerable code path via import without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of datamodel-code-generator. Attack surface: import / extras / DEFAULT_FIELD_KEYS / JsonSchemaObject.__init__.

🔥 Severity

Severity: High (CVSS 8.8/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 0.60.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'datamodel-code-generator' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'datamodel-code-generator' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で datamodel-code-generator を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade datamodel-code-generator to 0.60.2

    ステージング環境で 0.60.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip datamodel-code-generator
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.2"}]}]
PyPI datamodel-code-generator
[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.0"},{"fixed":"0.60.2"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details