These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The datamodel-code-generator library, used for generating Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various schema definitions, contains a critical vulnerability (CVE-2026-55415) that allows for newline injection and Python code execution when a generated model is imported. This issue arises from the library's handling of attacker-controlled x-python-import or customTypePath sche [truncated]
CVE-2026-55403 is a vulnerability in the datamodel-code-generator Python package that allows credentials scoped to one schema host to be leaked to another redirect target when following cross-origin redirects while fetching remote schemas. The issue was fixed in version 0.63.0. Defenders should assess exposure and prioritize upgrading to version 0.63.0 or later. The vulnerability impacts systems using the [truncated]
CVE-2026-55391 is a high-severity vulnerability in datamodel-code-generator that allows for DNS rebinding attacks, enabling attackers to bypass network restrictions and access internal services. The issue was patched in version 0.63.0. Users of datamodel-code-generator, especially those with exposure to internal services, should be aware of this vulnerability and take immediate action to patch their insta [truncated]
CVE-2026-55390 is a vulnerability in the datamodel-code-generator tool that allows arbitrary local files to be read and reflected into generated models. The issue is fixed in version 0.62.0. This vulnerability impacts defenders responsible for maintaining and securing systems that use datamodel-code-generator, as it could lead to potential unauthorized local file reading and reflection into generated mode [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-28T22:17:48.400Z and has not been modified since then. The vulnerability exists in datamodel-code-generator, which resolves JSON Schema $ref targets without containing file:// or ../ traversal references, allowing arbitrary local file reads. This issue is fixed in version 0.62.0. Users of datamodel- [truncated]
CVE-2026-54691 is a high-severity server-side request forgery vulnerability in the datamodel-code-generator Python package, allowing attackers to access loopback, private, link-local, metadata, and other network-accessible resources without host/IP validation. The issue exists from version 0.9.1 until 0.61.0 and is fixed in version 0.61.0. Defenders should assess exposure in their Python environments and [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-28T22:17:40.507Z and has not been modified since then. The NVD entry is currently Analyzed. The datamodel-code-generator tool generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various data formats. A vulnerability was found in versions 0.52.1 to 0.60.2, where validators f [truncated]
The CVE-2026-54655 vulnerability affects the datamodel-code-generator library, which generates Python data models from schema definitions. From version 0.51.0 to 0.60.2, the library inserts x-python-type values from JSON Schema content into generated field annotations without sufficient validation. This allows attacker-controlled JSON Schema content to execute Python code when the generated module is impo [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-28T22:17:40.217Z and has not been modified since then. The vulnerability in datamodel-code-generator allows attacker-controlled comment values to inject Python code into generated models. Defenders should assess exposure and prioritize remediation, especially for systems using versions between 0.14. [truncated]
The datamodel-code-generator library, used for generating Pydantic models from OpenAPI and other schema definitions, contains a high-severity vulnerability (CVSS score of 8.8). The issue, present from version 0.17.0 to 0.60.1, allows for code execution via attacker-controlled default_factory values in generated models. This is due to the library preserving these values in the generated code, enabling an a [truncated]
CVE-2026-54621 debrief: The datamodel-code-generator vulnerability allows code injection through attacker-controlled GraphQL schema content. This issue, fixed in version 0.60.1, affects Python developers using datamodel-code-generator, especially those utilizing GraphQL schema definitions. The vulnerability enables the injection of Python code into generated models, which can be exploited when imported. D [truncated]
CVE-2026-63720 is a high severity vulnerability in datamodel-code-generator prior to version 0.70.0 that allows for remote code execution via a malicious customBasePath value. This vulnerability is caused by a code injection issue where the customBasePath value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation. The vulnerability has a CVSS score of 7.5 and [truncated]