Datamodel-Code-Generator - CraftedSignal Threat Feed

`datamodel-code-generator` Vulnerable to Code Injection via `default_factory` Field

hello@craftedsignal.io — Tue, 28 Jul 2026 21:54:03 +0000

datamodel-code-generator versions 0.17.0 through 0.60.1 are affected by a high-severity code injection vulnerability (CVE-2026-54653) that allows for arbitrary Python code execution. This vulnerability arises when the tool generates Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. Specifically, if a property within the input schema contains a "default_factory" key, its value is interpolated verbatim as a raw Python expression into the generated Field(default_factory=...) or field(default_factory=...) call. This code executes at class-definition time when the generated Python module is imported by a consumer. No special CLI flags are required for exploitation, making any developer or CI pipeline processing untrusted schemas susceptible. The fix involves validating default_factory values to only accept dict, list, and set.

Attack Chain

An attacker crafts a malicious schema (e.g., JSON Schema, OpenAPI, YAML) containing a "default_factory" key with arbitrary Python code as its value.
A victim developer or CI pipeline uses datamodel-code-generator (versions 0.17.0 through 0.60.1) to generate Python data models from this attacker-controlled schema.
During code generation, the datamodel-code-generator parser (e.g., jsonschema.py) identifies the "default_factory" key.
The value associated with "default_factory" is retrieved from self.extras within the JsonSchemaObject.
When constructing the Python model (e.g., Pydantic v2, dataclass, msgspec), datamodel-code-generator interpolates the raw, unvalidated default_factory value directly into the generated Python code without sanitization.
The victim's Python application or environment imports the newly generated Python module.
Upon import, the interpolated malicious Python code embedded in the default_factory argument is executed at class-definition time within the importing process, leading to arbitrary code execution.
The attacker achieves their objective, such as filesystem reads (e.g., copying /etc/passwd), environment variable exfiltration, or secondary network calls.

Impact

This vulnerability poses a significant supply chain risk to developers and CI pipelines. Any environment that uses datamodel-code-generator to process schemas not authored internally (e.g., third-party API specs, public schema registries, vendored files, remote introspection endpoints) is directly affected. Successful exploitation leads to arbitrary Python code execution within the importing process at module import time. This can result in data exfiltration, system compromise (e.g., filesystem read/write, network access), or further malicious activity on CI runners where build environments often have elevated privileges. While typing.TypedDict output models are not vulnerable, all other supported output model types, including Pydantic v2, dataclasses, and msgspec, are susceptible.

Recommendation

Upgrade datamodel-code-generator to version 0.60.2 or later immediately to patch CVE-2026-54653.
Review CI/CD pipelines and developer workstations to ensure all instances of datamodel-code-generator are updated.
Implement controls to validate or restrict the source of schemas used for code generation, especially those from external or untrusted origins.
Monitor for unexpected process execution or file system modifications originating from Python processes that have recently imported newly generated data models, particularly if untrusted schemas are processed.

datamodel-code-generator Vulnerable to SSRF Protection Bypass via DNS Rebinding

hello@craftedsignal.io — Tue, 28 Jul 2026 21:49:12 +0000

The datamodel-code-generator Python library, specifically versions 0.62.0 and earlier, contains a high-severity Server-Side Request Forgery (SSRF) protection bypass vulnerability, tracked as CVE-2026-55391. Discovered by Hamza Haroon (thegr1ffyn), this flaw stems from a time-of-check/time-of-use (TOCTOU) race condition during DNS resolution, allowing a DNS rebinding attack. The library's anti-SSRF guard performs an initial IP validation that passes if a hostname resolves to a public IP; however, the subsequent httpx connection performs a separate, unpinned DNS resolution. An attacker can leverage this by controlling a low-TTL DNS record that resolves to a public IP during the validation phase and then switches to a private IP (e.g., 127.0.0.1 or 169.254.169.254) during the connection phase. This bypasses the intended private network protection, enabling access to internal network services, cloud instance metadata APIs, and internal host/port probing when the tool processes attacker-influenced URLs, such as those provided via the --url argument or remote $ref references in schemas. The vulnerability is present in versions up to 0.62.0 and was fixed in version 0.63.0.

Attack Chain

An attacker registers a domain name (e.g., attacker.com) and configures its DNS records with a very low Time-To-Live (TTL).
The attacker configures the domain to initially resolve to a public, internet-routable IP address.
The attacker influences a victim's datamodel-code-generator instance (e.g., in a CI pipeline or local development environment) to fetch a URL pointing to http://attacker.com/schema.json via the --url command-line argument or a remote $ref within a schema.
The datamodel-code-generator's _validate_url_for_fetch() function performs the initial DNS resolution of attacker.com (resolution #1). The public IP passes the SSRF guard's check.
Between validation and connection, the attacker rapidly changes the DNS record for attacker.com to resolve to a private IP address (e.g., 127.0.0.1, 169.254.169.254, or another internal network address).
The httpx.get() function within datamodel-code-generator performs its own, independent DNS resolution for attacker.com (resolution #2). Due to the low TTL and attacker's control, this resolution now returns the private IP address.
httpx connects to the private IP address, bypassing the initial validation and establishing an SSRF connection to an internal service or resource.
The attacker gains unauthorized access to internal HTTP services, reads cloud instance metadata credentials, or conducts internal network reconnaissance.

Impact

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) via a time-of-check/time-of-use (TOCTOU) resolution gap (CWE-367) affects any service or CI pipeline that executes datamodel-code-generator against attacker-influenced URLs. Successful exploitation allows attackers to bypass network segmentation controls, leading to the unauthorized disclosure of sensitive information such as cloud instance-metadata credentials (e.g., from 169.254.169.254). Attackers can also access internal-only HTTP services, perform port and host probing of the internal network, and reflect the content fetched from internal targets into the generated output, potentially exposing internal data. While specific victim counts are not available, the widespread use of datamodel-code-generator implies a broad attack surface for organizations using the tool in potentially vulnerable configurations.

Recommendation

Upgrade datamodel-code-generator to version 0.63.0 or later immediately to remediate CVE-2026-55391.
Implement strict network egress filtering on systems running datamodel-code-generator to restrict outbound connections to only necessary and trusted external destinations, blocking access to private IP ranges, especially 169.254.169.254.
Monitor DNS query logs for suspicious or rapid changes in IP resolution for external domains accessed by internal tools.
Avoid running datamodel-code-generator in environments where --url parameters or remote $ref references can be influenced by untrusted external input.