AIKIDO-2026-157708
datamodel-code-generator is vulnerable to Code Injection
78
High Risk
This Affects:
datamodel-code-generatorTL;DR
JSON Schema documents can include an x-python-type extension whose value is forwarded verbatim into generated Python field type annotations with only a trivial dot-based rewrite that is easy to bypass. Attacker-controlled schema input can embed statements after a crafted annotation that execute at class-definition time when the generated module is imported. Default settings reach this path without special CLI flags. The fix parses candidate values with ast.parse and accepts only expressions shaped like valid Python type annotations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
datamodel-code-generator is vulnerable to Code Injection in versions 0.51.0 - 0.60.1.
How to fix this
Upgrade the datamodel-code-generator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant