CVE-2026-54656

datamodel-code-generator versions 0.52.1 through before 0.60.2 interpolate validator definitions supplied via the --extra-template-data option (in _process_validators, src/datamodel_code_generator/model/pydantic_v2/base_model.py) directly into @field_validator decorators of generated Pydantic v2 models without safe validation. An attacker who can influence that input, for example through an untrusted schema, configuration, or CI pipeline, can embed arbitrary Python code that is written into the generated model, and the code executes when the generated module is imported. Successful exploitation yields arbitrary Python code execution in the developer machine, build/CI environment, or any application importing the affected generated model, with high confidentiality, integrity, and availability impact (CVSS 3.1: 7.8, CWE-94). Anyone using koxudaxi datamodel-code-generator in the affected version range who passes attacker-influenced content via --extra-template-data is exposed. There is no confirmed in-the-wild exploitation: EPSS is 0.2% (13th percentile), the flaw is not in CISA KEV, and the only public reference is the vendor's GitHub security advisory (GHSA-8m8r-38jm-f355).

What to do: Upgrade datamodel-code-generator to 0.60.2 or later. If upgrading is not immediately possible, restrict --extra-template-data to trusted content, avoid running the generator over untrusted schemas/configs, and re-generate affected models, reviewing generated files for unexpected code inside @field_validator decorators before importing them. Check CI pipelines and dependency manifests for pinned versions in the 0.52.1–0.60.2 range.