DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54653: CVE-2026-54653: Remote Code Execution via Code Injection in datamodel-code-generator

#security #cve #cybersecurity

CVE-2026-54653: Remote Code Execution via Code Injection in datamodel-code-generator

Vulnerability ID: CVE-2026-54653
CVSS Score: 8.8
Published: 2026-07-28

A critical code injection vulnerability exists in datamodel-code-generator from version 0.17.0 up to 0.60.1. The vulnerability allows remote attackers who supply a malicious JSON schema to execute arbitrary Python code. This occurs when the schema specifies a payload inside the 'default_factory' field extra, which is rendered directly into generated code without sanitization. When downstream processes load or import the output code, the evaluation of the class definition immediately triggers the execution of the injected code.

TL;DR

Unsanitized rendering of the 'default_factory' schema parameter allows unauthenticated remote attackers to inject arbitrary Python expressions, resulting in automatic code execution when downstream applications import the generated code.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.8
  • Exploit Status: Proof-of-Concept
  • Impact: Arbitrary Code Execution (RCE)
  • CISA KEV Status: Not Listed

Affected Systems

  • datamodel-code-generator
  • datamodel-code-generator: >= 0.17.0, < 0.60.2 (Fixed in: 0.60.2)

Code Analysis

Commit: 17fc235

Fix code injection vulnerability in default_factory handling by enforcing a strict validation whitelist.

Exploit Details

Mitigation Strategies

  • Upgrade datamodel-code-generator to version 0.60.2 or later.
  • Implement automated validation on JSON schemas to reject unexpected patterns in the default_factory property.
  • Isolate the model compilation process in an unprivileged runtime container with restricted system access.

Remediation Steps:

  1. Check current datamodel-code-generator dependency version.
  2. Run pip install --upgrade datamodel-code-generator>=0.60.2 to install the security patch.
  3. Audit pipeline configuration and restrict network access during automated module generation.
  4. Establish static analysis scanners to inspect generated python files for suspicious imports or function executions before production usage.

References

Read the full report for CVE-2026-54653 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)