CVE-2026-54655 in datamodel-code-generator
Summary
by MITRE • 07/29/2026
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The datamodel-code-generator project represents a widely used tool for automated Python data model generation from various schema definitions including jsonschema. This vulnerability affects versions between 0.51.0 and 0.60.2 where the tool processes x-python-type extensions within schema definitions without proper input validation mechanisms. The core flaw exists in the src/datamodel_code_generator/parser/jsonschema.py file within the _get_python_type_override function which directly incorporates attacker-controlled values into generated Python field annotations.
When processing JSON Schema content containing malicious x-python-type values, the parser fails to validate or sanitize these extensions before inserting them into the generated Python code. This creates a code injection vulnerability where arbitrary Python expressions can be executed during module import time. The vulnerability stems from insufficient validation of user-provided schema data and represents a classic insecure deserialization flaw where trusted input is treated as executable code.
The operational impact of this vulnerability extends beyond simple code execution to potentially allow remote code execution on systems that import or process generated models. Attackers could craft malicious JSON Schema files containing specially crafted x-python-type values that, when processed by the vulnerable tool, would generate Python modules with embedded malicious code. This risk is particularly concerning in automated build pipelines or environments where schema processing occurs without proper sandboxing.
This vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The attack pattern follows ATT&CK technique T1059.006 (Python) where adversaries leverage code injection to execute malicious Python payloads through legitimate system tools. The vulnerability demonstrates poor input validation practices and highlights the importance of sanitizing external schema content before incorporating it into generated code artifacts.
The fix implemented in version 0.60.2 addresses this by introducing proper validation mechanisms for x-python-type values, ensuring that only safe, pre-approved Python type specifications are allowed in generated models. Organizations should immediately upgrade to version 0.60.2 or later and review any existing generated models for potential compromise. Additionally, implementing proper input sanitization in schema processing pipelines and establishing secure code generation practices can mitigate similar risks in other tools that process external schema definitions.