{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/datamodel-code-generator/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["datamodel-code-generator (\u003e= 0.17.0, \u003c= 0.60.1)"],"_cs_severities":["high"],"_cs_tags":["code-injection","supply-chain","developer-tools","python","rce","cve"],"_cs_type":"advisory","_cs_vendors":["datamodel-code-generator"],"content_html":"\u003cp\u003e\u003ccode\u003edatamodel-code-generator\u003c/code\u003e versions 0.17.0 through 0.60.1 are affected by a high-severity code injection vulnerability (CVE-2026-54653) that allows for arbitrary Python code execution. This vulnerability arises when the tool generates Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. Specifically, if a property within the input schema contains a \u003ccode\u003e\u0026quot;default_factory\u0026quot;\u003c/code\u003e key, its value is interpolated verbatim as a raw Python expression into the generated \u003ccode\u003eField(default_factory=...)\u003c/code\u003e or \u003ccode\u003efield(default_factory=...)\u003c/code\u003e call. This code executes at class-definition time when the generated Python module is imported by a consumer. No special CLI flags are required for exploitation, making any developer or CI pipeline processing untrusted schemas susceptible. The fix involves validating \u003ccode\u003edefault_factory\u003c/code\u003e values to only accept \u003ccode\u003edict\u003c/code\u003e, \u003ccode\u003elist\u003c/code\u003e, and \u003ccode\u003eset\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious schema (e.g., JSON Schema, OpenAPI, YAML) containing a \u003ccode\u003e\u0026quot;default_factory\u0026quot;\u003c/code\u003e key with arbitrary Python code as its value.\u003c/li\u003e\n\u003cli\u003eA victim developer or CI pipeline uses \u003ccode\u003edatamodel-code-generator\u003c/code\u003e (versions 0.17.0 through 0.60.1) to generate Python data models from this attacker-controlled schema.\u003c/li\u003e\n\u003cli\u003eDuring code generation, the \u003ccode\u003edatamodel-code-generator\u003c/code\u003e parser (e.g., \u003ccode\u003ejsonschema.py\u003c/code\u003e) identifies the \u003ccode\u003e\u0026quot;default_factory\u0026quot;\u003c/code\u003e key.\u003c/li\u003e\n\u003cli\u003eThe value associated with \u003ccode\u003e\u0026quot;default_factory\u0026quot;\u003c/code\u003e is retrieved from \u003ccode\u003eself.extras\u003c/code\u003e within the \u003ccode\u003eJsonSchemaObject\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWhen constructing the Python model (e.g., Pydantic v2, dataclass, msgspec), \u003ccode\u003edatamodel-code-generator\u003c/code\u003e interpolates the raw, unvalidated \u003ccode\u003edefault_factory\u003c/code\u003e value directly into the generated Python code without sanitization.\u003c/li\u003e\n\u003cli\u003eThe victim's Python application or environment imports the newly generated Python module.\u003c/li\u003e\n\u003cli\u003eUpon import, the interpolated malicious Python code embedded in the \u003ccode\u003edefault_factory\u003c/code\u003e argument is executed at class-definition time within the importing process, leading to arbitrary code execution.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their objective, such as filesystem reads (e.g., copying \u003ccode\u003e/etc/passwd\u003c/code\u003e), environment variable exfiltration, or secondary network calls.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability poses a significant supply chain risk to developers and CI pipelines. Any environment that uses \u003ccode\u003edatamodel-code-generator\u003c/code\u003e to process schemas not authored internally (e.g., third-party API specs, public schema registries, vendored files, remote introspection endpoints) is directly affected. Successful exploitation leads to arbitrary Python code execution within the importing process at module import time. This can result in data exfiltration, system compromise (e.g., filesystem read/write, network access), or further malicious activity on CI runners where build environments often have elevated privileges. While \u003ccode\u003etyping.TypedDict\u003c/code\u003e output models are not vulnerable, all other supported output model types, including Pydantic v2, dataclasses, and msgspec, are susceptible.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003edatamodel-code-generator\u003c/code\u003e to version \u003ccode\u003e0.60.2\u003c/code\u003e or later immediately to patch CVE-2026-54653.\u003c/li\u003e\n\u003cli\u003eReview CI/CD pipelines and developer workstations to ensure all instances of \u003ccode\u003edatamodel-code-generator\u003c/code\u003e are updated.\u003c/li\u003e\n\u003cli\u003eImplement controls to validate or restrict the source of schemas used for code generation, especially those from external or untrusted origins.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected process execution or file system modifications originating from Python processes that have recently imported newly generated data models, particularly if untrusted schemas are processed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T21:54:03Z","date_published":"2026-07-28T21:54:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-rce/","summary":"The `datamodel-code-generator` library is vulnerable to code injection (CVE-2026-54653) when generating Python models from attacker-controlled schemas (e.g., JSON Schema, OpenAPI, YAML). This occurs because the `default_factory` schema field's value is interpolated directly as a raw Python expression into the generated code, allowing an attacker who controls the input schema to achieve arbitrary Python code execution within the consumer's process at module import time, affecting developers or CI pipelines that process untrusted schemas.","title":"`datamodel-code-generator` Vulnerable to Code Injection via `default_factory` Field","url":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-rce/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["datamodel-code-generator (\u003c= 0.62.0)"],"_cs_severities":["medium"],"_cs_tags":["ssrf","dns-rebinding","vulnerability","supply-chain","python"],"_cs_type":"advisory","_cs_vendors":["datamodel-code-generator"],"content_html":"\u003cp\u003eThe \u003ccode\u003edatamodel-code-generator\u003c/code\u003e Python library, specifically versions \u003ccode\u003e0.62.0\u003c/code\u003e and earlier, contains a high-severity Server-Side Request Forgery (SSRF) protection bypass vulnerability, tracked as CVE-2026-55391. Discovered by Hamza Haroon (thegr1ffyn), this flaw stems from a time-of-check/time-of-use (TOCTOU) race condition during DNS resolution, allowing a DNS rebinding attack. The library's anti-SSRF guard performs an initial IP validation that passes if a hostname resolves to a public IP; however, the subsequent \u003ccode\u003ehttpx\u003c/code\u003e connection performs a separate, unpinned DNS resolution. An attacker can leverage this by controlling a low-TTL DNS record that resolves to a public IP during the validation phase and then switches to a private IP (e.g., \u003ccode\u003e127.0.0.1\u003c/code\u003e or \u003ccode\u003e169.254.169.254\u003c/code\u003e) during the connection phase. This bypasses the intended private network protection, enabling access to internal network services, cloud instance metadata APIs, and internal host/port probing when the tool processes attacker-influenced URLs, such as those provided via the \u003ccode\u003e--url\u003c/code\u003e argument or remote \u003ccode\u003e$ref\u003c/code\u003e references in schemas. The vulnerability is present in versions up to \u003ccode\u003e0.62.0\u003c/code\u003e and was fixed in version \u003ccode\u003e0.63.0\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker registers a domain name (e.g., \u003ccode\u003eattacker.com\u003c/code\u003e) and configures its DNS records with a very low Time-To-Live (TTL).\u003c/li\u003e\n\u003cli\u003eThe attacker configures the domain to initially resolve to a public, internet-routable IP address.\u003c/li\u003e\n\u003cli\u003eThe attacker influences a victim's \u003ccode\u003edatamodel-code-generator\u003c/code\u003e instance (e.g., in a CI pipeline or local development environment) to fetch a URL pointing to \u003ccode\u003ehttp://attacker.com/schema.json\u003c/code\u003e via the \u003ccode\u003e--url\u003c/code\u003e command-line argument or a remote \u003ccode\u003e$ref\u003c/code\u003e within a schema.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edatamodel-code-generator\u003c/code\u003e's \u003ccode\u003e_validate_url_for_fetch()\u003c/code\u003e function performs the initial DNS resolution of \u003ccode\u003eattacker.com\u003c/code\u003e (resolution #1). The public IP passes the SSRF guard's check.\u003c/li\u003e\n\u003cli\u003eBetween validation and connection, the attacker rapidly changes the DNS record for \u003ccode\u003eattacker.com\u003c/code\u003e to resolve to a private IP address (e.g., \u003ccode\u003e127.0.0.1\u003c/code\u003e, \u003ccode\u003e169.254.169.254\u003c/code\u003e, or another internal network address).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehttpx.get()\u003c/code\u003e function within \u003ccode\u003edatamodel-code-generator\u003c/code\u003e performs its own, independent DNS resolution for \u003ccode\u003eattacker.com\u003c/code\u003e (resolution #2). Due to the low TTL and attacker's control, this resolution now returns the private IP address.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ehttpx\u003c/code\u003e connects to the private IP address, bypassing the initial validation and establishing an SSRF connection to an internal service or resource.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to internal HTTP services, reads cloud instance metadata credentials, or conducts internal network reconnaissance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis Server-Side Request Forgery (SSRF) vulnerability (CWE-918) via a time-of-check/time-of-use (TOCTOU) resolution gap (CWE-367) affects any service or CI pipeline that executes \u003ccode\u003edatamodel-code-generator\u003c/code\u003e against attacker-influenced URLs. Successful exploitation allows attackers to bypass network segmentation controls, leading to the unauthorized disclosure of sensitive information such as cloud instance-metadata credentials (e.g., from \u003ccode\u003e169.254.169.254\u003c/code\u003e). Attackers can also access internal-only HTTP services, perform port and host probing of the internal network, and reflect the content fetched from internal targets into the generated output, potentially exposing internal data. While specific victim counts are not available, the widespread use of \u003ccode\u003edatamodel-code-generator\u003c/code\u003e implies a broad attack surface for organizations using the tool in potentially vulnerable configurations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003edatamodel-code-generator\u003c/code\u003e to version \u003ccode\u003e0.63.0\u003c/code\u003e or later immediately to remediate CVE-2026-55391.\u003c/li\u003e\n\u003cli\u003eImplement strict network egress filtering on systems running \u003ccode\u003edatamodel-code-generator\u003c/code\u003e to restrict outbound connections to only necessary and trusted external destinations, blocking access to private IP ranges, especially \u003ccode\u003e169.254.169.254\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor DNS query logs for suspicious or rapid changes in IP resolution for external domains accessed by internal tools.\u003c/li\u003e\n\u003cli\u003eAvoid running \u003ccode\u003edatamodel-code-generator\u003c/code\u003e in environments where \u003ccode\u003e--url\u003c/code\u003e parameters or remote \u003ccode\u003e$ref\u003c/code\u003e references can be influenced by untrusted external input.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T21:49:12Z","date_published":"2026-07-28T21:49:12Z","id":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-ssrf-bypass/","summary":"The `datamodel-code-generator` tool is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass, identified as CVE-2026-55391, due to a time-of-check/time-of-use (TOCTOU) race condition through DNS rebinding, allowing attackers to access internal services like cloud instance metadata endpoints when processing attacker-influenced URLs.","title":"datamodel-code-generator Vulnerable to SSRF Protection Bypass via DNS Rebinding","url":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-ssrf-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Datamodel-Code-Generator","version":"https://jsonfeed.org/version/1.1"}