CVE-2026-54655: datamodel-code-generator RCE Vulnerability

CVE-2026-54655 Overview

CVE-2026-54655 is a code injection vulnerability [CWE-94] in datamodel-code-generator, a Python library that generates data models from schema definitions. Versions from 0.51.0 through 0.60.1 fail to validate x-python-type values parsed by _get_python_type_override in src/datamodel_code_generator/parser/jsonschema.py. Attacker-controlled JSON Schema content is inserted directly into generated field annotations. When a developer imports the generated Python module, embedded expressions execute in the interpreter. The maintainers fixed the issue in version 0.60.2.

Critical Impact
Malicious JSON Schema inputs execute arbitrary Python code when developers import the generated modules, leading to full compromise of the developer or build environment.

Affected Products

datamodel-code-generator versions 0.51.0 through 0.60.1
Python projects that generate models from untrusted JSON Schema, OpenAPI, or similar inputs
CI/CD pipelines that run datamodel-codegen against third-party schemas

Discovery Timeline

2026-07-28 - CVE-2026-54655 published to NVD
2026-07-29 - Last updated in NVD database
0.60.2 - Fix released via GitHub Release 0.60.2 and GHSA-m34r-v34r-rf9q

Technical Details for CVE-2026-54655

Vulnerability Analysis

The datamodel-code-generator project supports the x-python-type extension field in JSON Schema. This field lets schema authors override the Python type used in generated code. The _get_python_type_override function in src/datamodel_code_generator/parser/jsonschema.py reads this value and emits it verbatim into the annotation of a generated field. No parser confirms that the string is a valid Python type expression. Any arbitrary expression, including calls to os.system or subprocess.run, is written into the generated module. Python evaluates annotations at import time in many configurations, so the injected code runs the moment a downstream project imports the generated file.

Root Cause

The root cause is missing input validation on the x-python-type extension. The generator trusts schema authors and treats the value as a safe type annotation. Because generated code is typically committed to a repository or executed by developers, the trust boundary crossed here is significant.

Attack Vector

An attacker supplies a malicious JSON Schema, OpenAPI document, or similar input containing an x-python-type value with executable Python code. A developer or automated build system runs datamodel-codegen against the schema and imports the resulting module. Execution occurs with the privileges of the importing process, which is commonly a developer workstation or a CI runner with credentials.

python

# Security patch: src/datamodel_code_generator/types.py
# Adds AST-based validation restricting x-python-type values to real type expressions

@lru_cache(maxsize=1024)
def is_python_type_annotation(type_str: str) -> bool:
    """Return whether a string is a Python type annotation expression."""
    try:
        tree = ast.parse(type_str, mode="eval")
    except SyntaxError:
        return False

    return _is_python_type_annotation_node(tree.body, allow_literal=False)


def _is_python_type_annotation_node(node: ast.AST, *, allow_literal: bool) -> bool:
    match node:
        case ast.Name():
            result = True
        case ast.Attribute(value=value):
            result = isinstance(value, (ast.Name, ast.Attribute)) and _is_python_type_annotation_node(
                value,
                allow_literal=False,
            )
        case ast.Subscript(value=value, slice=slice_node):
            result = _is_python_type_annotation_node(
                value,
                allow_literal=False,
            ) and _is_python_type_annotation_node(slice_node, allow_literal=True)
        case ast.Tuple(elts=elts) | ast.List(elts=elts):
            result = all(_is_python_type_annotation_node(elt, allow_literal=True) for elt in elts)

Source: GitHub Commit 2c93c9b. The patch restricts x-python-type values to expressions parseable as Python type annotations, blocking calls and other non-type constructs.

Detection Methods for CVE-2026-54655

Indicators of Compromise

Presence of datamodel-code-generator versions between 0.51.0 and 0.60.1 in project dependencies or lockfiles
Generated Python modules containing suspicious identifiers in type annotations, such as os.system(...), subprocess, __import__, or eval
JSON Schema or OpenAPI documents containing x-python-type values that are not valid Python type expressions
Unexpected outbound network connections or child processes spawned when developers import generated model modules

Detection Strategies

Scan repositories for x-python-type fields in schema files and confirm each value parses as a plain type expression
Run static analysis over generated model files to flag annotations containing function calls or attribute access outside the typing and standard library namespaces
Include software composition analysis (SCA) rules that alert on installed datamodel-code-generator versions below 0.60.2

Monitoring Recommendations

Monitor CI/CD runners and developer endpoints for python or datamodel-codegen processes spawning shells, network utilities, or credential access tooling
Alert on modifications to generated model files that introduce non-type tokens into annotations
Track ingestion of third-party schema sources and require review before running code generation against them

How to Mitigate CVE-2026-54655

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.60.2 or later in all projects, requirements files, and container images
Audit recently generated model modules for injected code and regenerate them from trusted schemas after upgrading
Revoke and rotate any credentials that were present on hosts where vulnerable versions processed untrusted schemas

Patch Information

The fix is available in GitHub Release 0.60.2. The change, tracked in GHSA-m34r-v34r-rf9q and commit 2c93c9b, adds an is_python_type_annotation helper that validates x-python-type values against an allowlist of AST node types before emission.

Workarounds

Only run datamodel-codegen against schemas from trusted, authenticated sources until the upgrade is complete
Strip or reject x-python-type fields from schemas prior to code generation using a preprocessing step
Execute code generation inside an ephemeral sandbox or container without credentials or network access to limit impact if malicious input is processed

bash

# Pin a fixed version and remove x-python-type fields from untrusted schemas
pip install "datamodel-code-generator>=0.60.2"

# Strip x-python-type before generation as defense in depth
jq 'walk(if type == "object" then del(."x-python-type") else . end)' \
  untrusted-schema.json > sanitized-schema.json

datamodel-codegen --input sanitized-schema.json --output models.py