CVE-2026-54656 in datamodel-code-generator
Summary
by MITRE • 07/29/2026
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The datamodel-code-generator tool serves as a critical utility for developers working with data models in Python applications, particularly those leveraging Pydantic v2 for data validation and serialization. This vulnerability affects versions between 0.52.1 and 0.60.2 where the tool processes external template data through a dangerous interpolation mechanism that bypasses proper sanitization checks. The flaw exists specifically within the src/datamodel_code_generator/model/pydantic_v2/base_model.py file where validators are processed through the _process_validators function, creating a path for arbitrary Python code execution during model import operations.
The technical implementation of this vulnerability stems from improper handling of user-supplied data in the --extra-template-data parameter. When developers specify additional template data for code generation, the tool directly interpolates this content into generated Pydantic v2 models without adequate validation or sanitization. This interpolation occurs within the @field_validator decorator context, allowing malicious payloads embedded in the extra template data to be executed as Python code when the generated model is imported into a Python runtime environment. The vulnerability represents a classic code injection flaw that operates at the model generation level rather than runtime execution.
The operational impact of this vulnerability extends beyond simple code execution capabilities and creates significant security risks for development environments and production systems that utilize automated code generation workflows. An attacker who can influence or inject data into the --extra-template-data parameter could potentially execute arbitrary Python code on systems where generated models are imported, leading to potential system compromise, data exfiltration, or further attack escalation. This risk is particularly concerning in CI/CD pipelines and automated deployment environments where code generation tools are frequently used with external inputs.
The vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) while mapping to ATT&CK techniques including T1059.006 (Python) for code execution and T1211 (Social Engineering) when considering how attackers might gain access to modify template data. Organizations using this tool in their development workflows should immediately assess their usage patterns and implement proper input validation measures. The fix implemented in version 0.60.2 addresses the core issue by introducing proper sanitization of template data before interpolation, ensuring that user-supplied content cannot be executed as Python code within generated models.
This vulnerability demonstrates the critical importance of validating and sanitizing all external inputs in code generation tools, particularly those that produce executable code. The risk is amplified when these tools are integrated into automated systems where they may process untrusted input from various sources including configuration files, environment variables, or external APIs. Security teams should review their code generation workflows and ensure proper access controls are implemented to prevent unauthorized modification of template data files. The incident underscores the need for comprehensive security testing of development tooling and highlights the potential for supply chain attacks through vulnerable code generation utilities that operate in trusted development environments.
Organizations should conduct immediate vulnerability assessments of their datamodel-code-generator installations, particularly focusing on any automated processes that might expose the --extra-template-data parameter to untrusted inputs. The remediation approach in version 0.60.2 emphasizes proper input validation and sanitization practices that should be adopted across similar code generation tools within the development ecosystem. Regular security updates and vulnerability monitoring of development dependencies remain essential practices for maintaining secure software development lifecycles, especially when dealing with tools that generate executable code from external specifications.