Is CVE-2026-127208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127208 being exploited in the wild.

How severe is CVE-2026-127208?

High severity, with a CVSS score of 8.8, published 12 November 2026.

Which products and versions are affected?

Datamodel-Code-Generator before 0.84.0.

Is there a fix for CVE-2026-127208?

Yes: fixed in 0.84.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127208 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-127208?

Check whether you run Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127208: datamodel-code-generator code injection in type annotation parsing

CVE-2026-127208 · Severity: high · CVSS 8.8 · Published 2026-11-12

datamodel-code-generator is a tool that generates Python data model code from schemas like JSON Schema and OpenAPI. Before version 0.84.0, attackers can inject arbitrary Python code by crafting a malicious JSON Schema with specially formatted type annotations; the generated code then executes this malicious Python when imported into applications or CI/CD pipelines. This allows complete compromise of developer workstations and build systems that process untrusted schemas.

Quick answers

Is CVE-2026-127208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127208 being exploited in the wild.
How severe is CVE-2026-127208?: High severity, with a CVSS score of 8.8, published 12 November 2026.
Which products and versions are affected?: Datamodel-Code-Generator before 0.84.0.
Is there a fix for CVE-2026-127208?: Yes: fixed in 0.84.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127208 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-127208?: Check whether you run Datamodel-Code-Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.84.0

Technical details

The vulnerability is a code injection flaw in parse_python_type_annotation and _python_type_expr_from_ast functions that fail to validate string constants in subscript slice positions. An attacker supplies a JSON Schema with a crafted x-python-type annotation containing a quoted string (ast.Constant node) in a subscript, which bypasses validation and renders as a forward reference in generated Python code. When Pydantic v2 evaluates this generated code via eval() during model_rebuild(), arbitrary Python expressions embedded in the string literals are executed, granting arbitrary code execution to any system processing the schema.

Affected products

datamodel-code-generator datamodel-code-generator before 0.84.0

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.