https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:30:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54655 <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.</p> <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-54655 https://vulnerability.circl.lu/vuln/pysec-2026-3562 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial to bypass. An attacker who controls a JSON Schema fed to `datamodel-codegen` can therefore embed an arbitrary Python statement in the generated module, which executes at class-definition time the moment the developer imports the file. No `--extra-template-data` and no special flags are required; the vulnerable code is reachable with default settings.</p> <p>### Details Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_python_type_override` (lines 2055–2096, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_python_type_override(self, obj: JsonSchemaObject) -&gt; DataType | None: x_python_type = obj.extras.get(&#34;x-python-type&#34;) if not x_python_type or not isinstance(x_python_type, str): return None schema_type = obj.type if isinstance(obj.type, str) else None if self._is_compatible_python_type(schema_type, x_python_type): return None base_type = self._get_python_type_base(x_python_type) import_ = self._resolve_type_import(base_type) type_str = x_python_type prefix = x_python_type.split(&#34;[&#34;, maxsplit=1)[0] if &#34;.&#34; in prefix: # only sanitiser type_str = base_type + x_python_t…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial to bypass. An attacker who controls a JSON Schema fed to `datamodel-codegen` can therefore embed an arbitrary Python statement in the generated module, which executes at class-definition time the moment the developer imports the file. No `--extra-template-data` and no special flags are required; the vulnerable code is reachable with default settings.</p> <p>### Details Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_python_type_override` (lines 2055–2096, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_python_type_override(self, obj: JsonSchemaObject) -&gt; DataType | None: x_python_type = obj.extras.get(&#34;x-python-type&#34;) if not x_python_type or not isinstance(x_python_type, str): return None schema_type = obj.type if isinstance(obj.type, str) else None if self._is_compatible_python_type(schema_type, x_python_type): return None base_type = self._get_python_type_base(x_python_type) import_ = self._resolve_type_import(base_type) type_str = x_python_type prefix = x_python_type.split(&#34;[&#34;, maxsplit=1)[0] if &#34;.&#34; in prefix: # only sanitiser type_str = base_type + x_python_t…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3562