CVE-2026-54655

Code injection in datamodel-code-generator via malicious x-python-type.

• CVSS 7.8
• 94
• Input Validation and Sanitization
• Local

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

CVE

CVE-2026-54655

CWE

94

CVSS base score

7.8

Published

2026-07-28

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

datamodel-co

Fixed by upgrading

Yes

Solution

Upgrade datamodel-code-generator to version 0.60.2 or later.

from typing import Any, Dict, Optional

X_PYTHON_TYPE_KEY = 'x-python-type'

# Simplified for demonstration
class PythonType:
    def __init__(self, type: Optional[str] = None):
        self.type: Optional[str] = type

class JSONSchemaParser:
    def _get_python_type_override(self, data: Dict[str, Any]) -> Optional[PythonType]:
        if X_PYTHON_TYPE_KEY in data:
            # VULNERABLE: The 'x-python-type' value is used directly as a type annotation without validation.
            return PythonType(type=data[X_PYTHON_TYPE_KEY])
        return None

import ast
from typing import Any, Dict, Optional

X_PYTHON_TYPE_KEY = 'x-python-type'

# Simplified for demonstration
class PythonType:
    def __init__(self, type: Optional[str] = None):
        self.type: Optional[str] = type

class JSONSchemaParser:
    def _get_python_type_override(self, data: Dict[str, Any]) -> Optional[PythonType]:
        if X_PYTHON_TYPE_KEY in data:
            python_type = data[X_PYTHON_TYPE_KEY]
            # FIX: Validate that the 'x-python-type' value is syntactically valid Python code.
            try:
                ast.parse(python_type)
            except (SyntaxError, ValueError):
                return None
            return PythonType(type=python_type)
        return None

{
  "type": "object",
  "properties": {
    "malicious_field": {
      "type": "string",
      "x-python-type": "__import__('os').system('touch /tmp/pwned')"
    }
  }
}

@misc{vaitp:cve202654655,
  title        = {{Code injection in datamodel-code-generator via malicious x-python-type.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-54655},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-54655/}}
}