CVE-2026-54656

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.

• CWE-94

• https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19Patch
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2Release Notes
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355Exploit, Vendor Advisory
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355Exploit, Vendor Advisory

Published

Jul 28, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54650openhole exposes localhost to the internet in one command. I…8.6
• CVE-2026-54651pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-54652Frigate is an open source network video recorder. In version…8.1
• CVE-2026-54653datamodel-code-generator generates Pydantic v2 models, datac…8.8
• CVE-2026-54654datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54655datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54658Hypequery is a TypeScript semantic layer for ClickHouse. Pri…9.8
• CVE-2026-54659Pagy is agnostic pagination in plain Ruby. From 43.0.0 until…6.9
• CVE-2026-5466wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` deco…8.1
• CVE-2026-54660swagger-typescript-api generates API clients for Fetch or Ax…7.4
• CVE-2026-54661swagger-typescript-api generates API clients for Fetch or Ax…8.3
• CVE-2026-54662swagger-typescript-api generates API clients for Fetch or Ax…8.3