CVE-2026-54653 Koxudaxi CVE debrief

Who should care

Organizations using datamodel-code-generator, especially those generating models from untrusted or user-supplied schema definitions, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing their usage of the library, assessing potential exposure, and applying the patch or other compensating controls as necessary.

Technical summary

The datamodel-code-generator library, used for generating Pydantic models from OpenAPI and other schema definitions, contains a high-severity vulnerability (CVSS score of 8.8). The issue, present from version 0.17.0 to 0.60.1, allows for code execution via attacker-controlled default_factory values in generated models. This is due to the library preserving these values in the generated code, enabling an attacker to inject and execute arbitrary Python expressions when the generated model is imported. The vulnerability is fixed in version 0.60.2.

Defensive priority

High-priority defensive review recommended due to high CVSS score of 8.8 and potential for code execution.

Recommended defensive actions

• Review and apply patch version 0.60.2 or later
• Inventory and assess affected systems for datamodel-code-generator usage
• Implement compensating controls to detect and prevent potential code execution
• Monitor for suspicious activity related to generated models
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE and NVD sources indicates a high-severity vulnerability in datamodel-code-generator. The vulnerability allows for code execution via attacker-controlled default_factory values. Limited evidence available on exploitability and affected systems.

Official resources