CVE-2026-54656

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1

Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators() function in src/datamodel code generator/model/pydantic v2/base model.py interpolates validator field names and modes into @field validator decorators without safe validation or escaping. An attacker can provide a value containing a single quote to break out of the string literal and inject arbitrary Python expressions. Additionally, the Import.from full path() function can be exploited by inserting a semicolon into the function path to execute statements during module load. This allows for remote code execution (RCE) in the developer's interpreter or CI runner the moment the generated module is imported.

Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later.