{"id":"CVE-2026-54655","aliases":["GHSA-m34r-v34r-rf9q","PYSEC-2026-3562"],"url":"https://o3.security/vulnerability/CVE-2026-54655","summary":"`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator","details":"datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.","published":"2026-07-28T21:33:45.438Z","modified":"2026-09-11T11:46:56.790925011Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.00145,"percentile":0.04098,"asOf":"2026-09-10"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"datamodel-code-generator","fixedVersion":"0.60.2"}],"fix":{"url":"https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba","label":"koxudaxi/datamodel-code-generator@2c93c9b"},"references":[{"type":"WEB","url":"https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54655.json"},{"type":"ADVISORY","url":"https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54655"},{"type":"FIX","url":"https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T11:46:56.790925011Z"}}