Affected: koxudaxi datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

Affected: PyPI: datamodel-code-generator

### Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial to bypass. An attacker who controls a JSON Schema fed to `datamodel-codegen` can therefore embed an arbitrary Python statement in the generated module, which executes at class-definition time the moment the developer imports the file. No `--extra-template-data` and no special flags are required; the vulnerable code is reachable with default settings.

### Details Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_python_type_override` (lines 2055–2096, at tag `0.60.1` / commit `a321547e`):

```python def _get_python_type_override(self, obj: JsonSchemaObject) -> DataType | None: x_python_type = obj.extras.get("x-python-type") if not x_python_type or not isinstance(x_python_type, str): return None schema_type = obj.type if isinstance(obj.type, str) else None if self._is_compatible_python_type(schema_type, x_python_type): return None base_type = self._get_python_type_base(x_python_type) import_ = self._resolve_type_import(base_type) type_str = x_python_type prefix = x_python_type.split("[", maxsplit=1)[0] if "." in prefix: # only sanitiser type_str = base_type + x_python_t…