CVE-2026-54655
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
41/100
Published: 2026-07-28
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.