CVE-2026-54655

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54655", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T20:16:46.199Z", "datePublished": "2026-07-28T21:33:45.438Z", "dateUpdated": "2026-07-29T12:47:08.130Z"}, "containers": {"cna": {"title": "`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q"}, {"name": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba", "tags": ["x_refsource_MISC"], "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba"}, {"name": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"}], "affected": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"version": ">= 0.51.0, < 0.60.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T21:33:45.438Z"}, "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2."}], "source": {"advisory": "GHSA-m34r-v34r-rf9q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T12:46:44.431126Z", "id": "CVE-2026-54655", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:47:08.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54655", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T12:46:44.431126Z"}}}], "references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:47:04.681Z"}}], "cna": {"title": "`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator", "source": {"advisory": "GHSA-m34r-v34r-rf9q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"status": "affected", "version": ">= 0.51.0, < 0.60.2"}]}], "references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "name": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba", "name": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2", "name": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T21:33:45.438Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54655", "state": "PUBLISHED", "dateUpdated": "2026-07-29T12:47:08.130Z", "dateReserved": "2026-06-15T20:16:46.199Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T21:33:45.438Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "datamodel-code-generator", "vendor": "koxudaxi", "versions": [{"status": "affected", "version": ">= 0.51.0, < 0.60.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2."}, {"lang": "es", "value": "datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Desde la versi\u00f3n 0.51.0 hasta la 0.60.2, los valores x-python-type analizados por src/datamodel_code_generator/parser/jsonschema.py en _get_python_type_override se insertan en las anotaciones de campo generadas sin validaci\u00f3n suficiente, lo que permite que el contenido de esquema JSON controlado por el atacante ejecute c\u00f3digo Python cuando se importa el m\u00f3dulo generado. Este problema est\u00e1 corregido en la versi\u00f3n 0.60.2."}], "id": "CVE-2026-54655", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54655", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T12:46:44.431126Z", "version": "2.0.3"}}]}, "published": "2026-07-28T22:17:40.360", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba"}, {"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.51.0,0.60.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "datamodel-code-generator", "source": "cna", "vendor": "koxudaxi"}, "product": "datamodel-code-generator", "vendor": "koxudaxi"}], "created": "2026-07-28T23:30:03.480736+00:00", "updated": "2026-08-03T14:15:05.546844+00:00", "vendors": ["koxudaxi", "koxudaxi$PRODUCT$datamodel-code-generator"]}