# CVE-2026-54656: koxudaxi datamodel-code-generator code injection in Pydantic v2 validators

Source: https://junglewise.ai/threats/cve-2026-54656-koxudaxi-datamodel-code-generator-code-injection-in-pydantic-v2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-54656 · Severity: high · CVSS 7.8 · Published 2026-07-28

datamodel-code-generator is a tool used by developers to automatically create Python code from data schemas like OpenAPI or JSON Schema. A security flaw allows an attacker to provide a malicious configuration file that injects hidden Python code into the generated files. If a developer or automated system then imports this generated code, the hidden commands will execute immediately, potentially allowing the attacker to steal data, compromise development environments, or disrupt operations.

Technologies: [Koxudaxi Datamodel-Code-Generator](https://junglewise.ai/threats/technologies/datamodel-code-generator), [datamodel-code-generator (PyPI)](https://junglewise.ai/threats/technologies/pypi-datamodel-code-generator). Vendors: [Koxudaxi](https://junglewise.ai/threats/vendors/koxudaxi), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54656 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54656 being exploited in the wild.

**How severe is CVE-2026-54656?** High severity, with a CVSS score of 7.8, published 28 July 2026.

**Which products and versions are affected?** Koxudaxi Datamodel-Code-Generator >= 0.52.1, <= 0.60.1; datamodel-code-generator (PyPI) ECOSYSTEM:introduced=0.52.1,fixed=0.60.2.

**Is there a fix for CVE-2026-54656?** Yes. datamodel-code-generator (PyPI): upgrade to 0.60.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54656 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54656?** Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- datamodel-code-generator (PyPI): upgrade to 0.60.2 or later

  ```sh
  pip install "datamodel-code-generator>=0.60.2"
  ```


## Technical details

A code injection vulnerability exists in datamodel-code-generator versions 0.52.1 through 0.60.1 when using the Pydantic v2 output mode. The tool interpolates validator definitions from the --extra-template-data file into @field_validator decorators without proper escaping or validation. Specifically, the _process_validators function in src/datamodel_code_generator/model/pydantic_v2/base_model.py wraps field names and validator modes in unescaped single quotes. An attacker can use a single quote to break out of the string literal and inject arbitrary Python expressions. These expressions are executed at class-definition time when the generated module is imported. The issue is fixed in version 0.60.2 by implementing strict validation of validator entries and using repr() for rendering.

## Affected products

- koxudaxi datamodel-code-generator >= 0.52.1, <= 0.60.1

## Identifiers

- CVE-2026-54656
- GHSA-8m8r-38jm-f355
- PYSEC-2026-3559

## Timeline

- 2026-06-08: patched: Fixed in version 0.60.2
- 2026-07-28: disclosed: Advisory published via GitHub and NVD

## References

- [https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19](https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19)
- [https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)
- [https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355)

## Related threats

- [datamodel-code-generator Protobuf path traversal allows files to be written outside directory](https://junglewise.ai/threats/cve-2026-107377-datamodel-code-generator-protobuf-weak-import-path-traversal)
- [koxudaxi datamodel-code-generator code injection in generated imports](https://junglewise.ai/threats/cve-2026-55415-koxudaxi-datamodel-code-generator-code-injection-in-generated)
- [koxudaxi datamodel-code-generator credential leak in cross-origin redirects](https://junglewise.ai/threats/cve-2026-55403-koxudaxi-datamodel-code-generator-credential-leak-in-cross-origin)
- [koxudaxi datamodel-code-generator SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-55391-koxudaxi-datamodel-code-generator-ssrf-via-dns-rebinding)
- [koxudaxi datamodel-code-generator path traversal in XML Schema parsing](https://junglewise.ai/threats/cve-2026-55390-koxudaxi-datamodel-code-generator-path-traversal-in-xml-schema)