DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54656: CVE-2026-54656: Arbitrary Code Execution in datamodel-code-generator via Unescaped Validator Configurations

#security #cve #cybersecurity

CVE-2026-54656: Arbitrary Code Execution in datamodel-code-generator via Unescaped Validator Configurations

Vulnerability ID: CVE-2026-54656
CVSS Score: 7.8
Published: 2026-07-28

CVE-2026-54656 is a high-severity arbitrary code execution vulnerability in the koxudaxi/datamodel-code-generator Python package. When processing validator metadata from external configuration files passed via the --extra-template-data argument, the code generator performs unescaped string interpolation into Pydantic v2 @field_validator decorators. This allows local attackers to construct malicious configuration files that inject arbitrary Python statements into generated models, executing code upon downstream import. This vulnerability has been resolved in version 0.60.2.

TL;DR

Unescaped string formatting in Pydantic v2 validator generation enables arbitrary code execution at module import time when processing malicious configurations.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94
  • Attack Vector: Local
  • CVSS v3.1: 7.8 (High)
  • Exploit Status: poc
  • Impact: Arbitrary Code Execution
  • Affected Range: >= 0.52.1, < 0.60.2
  • Patched Version: 0.60.2

Affected Systems

  • datamodel-code-generator
  • datamodel-code-generator: >= 0.52.1, < 0.60.2 (Fixed in: 0.60.2)

Code Analysis

Commit: a43d029

Fix: Escape string interpolation inside validators by using repr() and normalizing with Pydantic schemas

Mitigation Strategies

  • Upgrade to version 0.60.2 or higher
  • Implement schema validation for configuration files passed to --extra-template-data
  • Isolate compilation steps within sandboxed CI/CD environments

Remediation Steps:

  1. Audit existing code generation pipelines for datamodel-code-generator dependencies between versions 0.52.1 and 0.60.1
  2. Upgrade the datamodel-code-generator package in lockfiles or requirements definitions to 0.60.2
  3. Block or filter user-supplied configuration configurations that contain special characters, single quotes, or semi-colons under validator fields

References

Read the full report for CVE-2026-54656 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)