CVE-2026-54656

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada koxudaxi datamodel-code-generator. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.

Rincian

Terbit di NVD

28 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355 exploit · advisory vendor
• https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19 patch
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 release notes