CVE-2026-54653: datamodel-code-generator RCE Vulnerability

CVE-2026-54653 Overview

CVE-2026-54653 is a code injection vulnerability [CWE-94] in datamodel-code-generator, a Python library that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from schema formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, JSON, YAML, and CSV. Versions from 0.17.0 up to 0.60.2 preserve attacker-controlled default_factory values from input schemas and emit them directly into generated Field(default_factory=...) or field(default_factory=...) calls. When a developer imports the generated model, the embedded Python expression executes. The maintainer fixed the issue in version 0.60.2.

Critical Impact
A malicious schema can execute arbitrary Python code on any developer or CI system that imports models generated by vulnerable versions of datamodel-code-generator.

Affected Products

datamodel-code-generator versions 0.17.0 through 0.60.1
Downstream projects consuming untrusted OpenAPI or JSON Schema documents
CI/CD pipelines that auto-generate Pydantic models from third-party schemas

Discovery Timeline

2026-07-28 - CVE-2026-54653 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54653

Vulnerability Analysis

The flaw lives in src/datamodel_code_generator/parser/jsonschema.py. The JsonSchemaObject.__init__ method and the get_field_extras helper propagate the default_factory value from a parsed schema straight into generated source code. The generator does not validate that the value is a safe callable name.

When the produced module is later imported, Python evaluates the expression bound to default_factory. An attacker can supply an arbitrary expression such as a function call that spawns a shell, reads secrets, or performs network egress. Execution occurs on the machine that imports the generated model, which typically means a developer workstation or a CI runner with source repository access.

Root Cause

The root cause is missing input sanitization on schema fields that map to code emission. The generator treats default_factory as trusted metadata rather than untrusted input. Because the value is written into Python source that is later executed by the interpreter, the vulnerability satisfies the classic definition of Improper Control of Generation of Code [CWE-94].

Attack Vector

Exploitation requires a victim to run datamodel-codegen against an attacker-controlled schema and then import the generated module. Common delivery paths include pull requests that modify vendored schemas, compromised OpenAPI documents fetched over the network, and public API descriptions consumed by client SDK generators.

python

# Patch from src/datamodel_code_generator/parser/jsonschema.py
# Source: https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1d

ALLOWED_DEFAULT_FACTORIES: frozenset[str] = frozenset({"dict", "list", "set"})


def _validate_default_factory(default_factory: Any) -> str:
    if isinstance(default_factory, str) and default_factory in ALLOWED_DEFAULT_FACTORIES:
        return default_factory
    allowed_values = ", ".join(sorted(ALLOWED_DEFAULT_FACTORIES))
    msg = f"default_factory must be one of: {allowed_values}"
    raise Error(msg)

The fix constrains default_factory to an allowlist of dict, list, and set. Any other value raises an error before code emission.

Detection Methods for CVE-2026-54653

Indicators of Compromise

Generated Python files containing Field(default_factory=...) or field(default_factory=...) referencing callables outside dict, list, or set.
Unexpected child processes spawned by python -c "import <generated_module>" in CI logs.
Outbound network connections from build agents immediately after schema regeneration steps.

Detection Strategies

Grep repositories and build artifacts for default_factory= values that are not dict, list, or set, and flag any function call or lambda expressions.
Pin and inventory the installed version of datamodel-code-generator across developer workstations and pipelines using pip show datamodel-code-generator.
Review pull requests that introduce or modify JSON Schema, OpenAPI, or Avro files for default_factory keys.

Monitoring Recommendations

Monitor CI runners for process execution and outbound connections triggered by Python import events during code generation stages.
Alert on new writes to files under models/ or generator output paths that contain executable expressions in defaults.
Track dependency updates to ensure datamodel-code-generator remains at 0.60.2 or later across build environments.

How to Mitigate CVE-2026-54653

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.60.2 or later on every workstation, container image, and CI runner.
Audit already-generated model files for suspicious default_factory values and regenerate them from trusted schemas after upgrading.
Treat third-party OpenAPI and JSON Schema documents as untrusted input and validate them before running the generator.

Patch Information

The fix is available in datamodel-code-generator release 0.60.2. Full details are documented in GitHub Security Advisory GHSA-386q-5hp3-95m9. The remediating change is captured in commit 17fc235.

Workarounds

Run code generation inside an isolated container with no secrets, no persistent storage, and no network egress.
Preprocess input schemas to strip any default_factory key before invoking the generator on versions prior to 0.60.2.
Require code review on all generated model files before they are imported by application or CI code.

bash

# Upgrade to the patched release
pip install --upgrade 'datamodel-code-generator>=0.60.2'

# Verify installed version
pip show datamodel-code-generator | grep -i version

# Sanitize schemas before generation on legacy versions
jq 'del(.. | .default_factory?)' schema.json > schema.sanitized.json