CVE-2026-54653

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.

• CWE-94
• CWE-1336

• https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1dPatch
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2Release Notes
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9Exploit, Vendor Advisory
• https://gist.github.com/thegr1ffyn/9648b0fe4fcf7d569ac8e61dd11eebafThird Party Advisory

Published

Jul 28, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-5465The Booking for Appointments and Events Calendar – Amelia pl…8.8
• CVE-2026-54650openhole exposes localhost to the internet in one command. I…8.6
• CVE-2026-54651pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-54652Frigate is an open source network video recorder. In version…8.1
• CVE-2026-54654datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54655datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54656datamodel-code-generator generates Pydantic v2 models, datac…7.8
• CVE-2026-54658Hypequery is a TypeScript semantic layer for ClickHouse. Pri…9.8
• CVE-2026-54659Pagy is agnostic pagination in plain Ruby. From 43.0.0 until…6.9
• CVE-2026-5466wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` deco…8.1