PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54653 Koxudaxi CVE debrief

The datamodel-code-generator library, used for generating Pydantic models from OpenAPI and other schema definitions, contains a high-severity vulnerability (CVSS score of 8.8). The issue, present from version 0.17.0 to 0.60.1, allows for code execution via attacker-controlled default_factory values in generated models. This is due to the library preserving these values in the generated code, enabling an attacker to inject and execute arbitrary Python expressions when the generated model is imported. Organizations using datamodel-code-generator, especially those generating models from untrusted or user-supplied schema definitions, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing their usage of the library, assessing potential exposure, and applying the patch or other compensating controls as necessary. The CVE record was published on 2026-07-28T22:17:40.077Z and has not been modified since then. The NVD entry is currently Analyzed.

Vendor
Koxudaxi
Product
datamodel-code-generator
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-28
Original CVE updated
2026-08-06
Advisory published
2026-07-28
Advisory updated
2026-08-06

Who should care

Organizations using datamodel-code-generator, especially those generating models from untrusted or user-supplied schema definitions, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing their usage of the library, assessing potential exposure, and applying the patch or other compensating controls as necessary.

Technical summary

The datamodel-code-generator library, used for generating Pydantic models from OpenAPI and other schema definitions, contains a high-severity vulnerability (CVSS score of 8.8). The issue, present from version 0.17.0 to 0.60.1, allows for code execution via attacker-controlled default_factory values in generated models. This is due to the library preserving these values in the generated code, enabling an attacker to inject and execute arbitrary Python expressions when the generated model is imported. The vulnerability is fixed in version 0.60.2.

Defensive priority

High-priority defensive review recommended due to high CVSS score of 8.8 and potential for code execution.

Recommended defensive actions

  • Review and apply patch version 0.60.2 or later
  • Inventory and assess affected systems for datamodel-code-generator usage
  • Implement compensating controls to detect and prevent potential code execution
  • Monitor for suspicious activity related to generated models
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE and NVD sources indicates a high-severity vulnerability in datamodel-code-generator. The vulnerability allows for code execution via attacker-controlled default_factory values. Limited evidence available on exploitability and affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54653 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54653

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54653 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54653

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.