CVE-2026-54656 koxudaxi CVE debrief

Who should care

Organizations using datamodel-code-generator, especially those generating Pydantic v2 models, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing their current version of datamodel-code-generator, applying the patch version 0.60.2 or later, and monitoring for potential exploitation attempts. Additionally, organizations should review and update their security controls for Python environments to prevent potential code execution.

Technical summary

The datamodel-code-generator tool generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various data formats. A vulnerability was found in versions 0.52.1 to 0.60.2, where validators from --extra-template-data were interpolated into @field_validator decorators without safe validation. This allows Python code execution when the generated Pydantic v2 model is imported. The issue is fixed in version 0.60.2. Users of datamodel-code-generator should be aware of this vulnerability and take steps to mitigate it, especially those generating Pydantic v2 models.

Defensive priority

High priority due to high CVSS score of 7.8 and potential for code execution.

Recommended defensive actions

• Inventory and check affected versions of datamodel-code-generator
• Apply patch version 0.60.2 or later
• Monitor for potential exploitation attempts
• Review and update security controls for Python environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence from NVD and CVE.org indicates a high-severity vulnerability in datamodel-code-generator, allowing Python code execution when importing generated Pydantic v2 models. The issue is fixed in version 0.60.2. Further review of the datamodel-code-generator's handling of --extra-template-data and its impact on Pydantic v2 model generation is recommended. Organizations should verify their use of affected versions and monitor for potential exploitation attempts. Additional information can be found in the official CVE record and NVD detail page.

Official resources