p PatchFirst

CVE-2026-54653

CVE-2026-54653 · `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.

CVSS 8.8 · Alta · EPSS 0,7% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • datamodel-code-generator

    Versiones
    • >= 0.17.0, < 0.60.2: Afectada

    Sin corrección publicada

  • datamodel-code-generator PyPI

    Versiones
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.18.0
    • 0.18.1
    • 0.19.0
    • 0.20.0
    • 0.21.0
    • 0.21.1
    • 0.21.2
    • 0.21.3
    • 0.21.4
    • 0.21.5
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.24.0
    • 0.24.1
    • 0.24.2
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.25.3
    • 0.25.4
    • 0.25.5
    • 0.25.6
    • 0.25.7
    • 0.25.8
    • 0.25.9
    • 0.26.0
    • 0.26.1
    • 0.26.2
    • 0.26.3
    • 0.26.4
    • 0.26.5
    • 0.27.0
    • 0.27.1
    • 0.27.2
    • 0.27.3
    • 0.28.0
    • 0.28.1
    • 0.28.2
    • 0.28.3
    • 0.28.4
    • 0.28.5
    • 0.29.0
    • 0.30.0
    • 0.30.1
    • 0.30.2
    • 0.31.0
    • 0.31.1
    • 0.31.2
    • 0.32.0
    • 0.33.0
    • 0.34.0
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.38.0
    • 0.39.0
    • 0.40.0
    • 0.41.0
    • 0.42.0
    • 0.42.1
    • 0.42.2
    • 0.43.0
    • 0.43.1
    • 0.44.0
    • 0.45.0
    • 0.46.0
    • 0.47.0
    • 0.48.0
    • 0.49.0
    • 0.50.0
    • 0.51.0
    • 0.52.0
    • 0.52.1
    • 0.52.2
    • 0.53.0
    • 0.54.0
    • 0.54.1
    • 0.55.0
    • 0.56.0
    • 0.56.1
    • 0.57.0
    • 0.58.0
    • 0.59.0
    • 0.59.1
    • 0.60.0
    • 0.60.1
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 0.17.0, < 0.60.2

    Actualiza a 0.60.2

Fuentes originales

Comprueba tu servidor →