CVE-2026-127208

datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse python type annotation and python type expr from ast. Attackers can embed malicious Python expressions such as import calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime.