AIKIDO-2026-865267
datamodel-code-generator is vulnerable to Code Injection
78
High Risk
This Affects:
datamodel-code-generatorTL;DR
In Pydantic v2 output mode, validators entries from --extra-template-data are used to synthesize @field_validator(...) decorators with field names and modes interpolated in unescaped single-quoted strings. A value containing ' breaks out of the string literal and can inject arbitrary Python expressions evaluated at class-definition time on import. The validator function import path is also insufficiently validated before being emitted into generated import statements. The fix validates entries with Pydantic models and renders decorator arguments using repr() and safe string literals.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and supply Pydantic v2 validator definitions through --validators or --extra-template-data.
Background info
datamodel-code-generator is vulnerable to Code Injection in versions 0.52.1 - 0.60.1.
How to fix this
Upgrade the datamodel-code-generator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant