datamodel-code-generator: Code injection vulnerability (CVE-2026-127208)
The datamodel-code-generator package is vulnerable to code injection, allowing arbitrary code execution when processing malicious JSON Schema files that trigger Pydantic model evaluation.
CVE search metadata
CVE search record: CVE-2026-127208. Severity: high. CVSS: 8.8. KEV: no. Product: datamodel-code-generator. Brief: datamodel-code-generator: Code injection vulnerability (CVE-2026-127208). Brief link: https://feed.craftedsignal.io/briefs/2026-11-datamodel-code-generator-injection-cve-2026-127208/
Triage facts
Revision 1- Applicability
- datamodel-code-generator
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 22:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
datamodel-code-generator versions prior to 0.84.0 contain a code injection vulnerability. An attacker can supply a malicious JSON Schema containing a crafted 'x-python-type' annotation. This annotation bypasses internal validation checks, allowing the insertion of arbitrary Python expressions into the generated source code. When these generated models are processed by Pydantic v2 during the 'model_rebuild()' method, the embedded expressions are evaluated via 'eval()', leading to arbitrary code execution.
Impact
Successful exploitation results in arbitrary code execution within the environment where the models are generated or imported, such as developer workstations, CI/CD pipelines, or runtime application environments.
Recommendation
Upgrade datamodel-code-generator to version 0.84.0 or later.