Code Injection Vulnerability in datamodel-code-generator by datamodel-code-generator

CVE-2026-127208

What is CVE-2026-127208?

The datamodel-code-generator, prior to version 0.84.0, is susceptible to a code injection vulnerability. This flaw permits attackers to execute arbitrary code by feeding a malicious JSON Schema that includes a crafted 'x-python-type' annotation, specifically employing a string ast.Constant node in a subscript slice position. This bypasses validation processes in the functions parse_python_type_annotation and _python_type_expr_from_ast. Consequently, attackers can embed harmful Python expressions, including import calls, within quoted string literals in the generated source code. During the model rebuilding process managed by Pydantic v2, these expressions are evaluated as ForwardRefs through the eval() function, potentially resulting in arbitrary code execution on developer workstations, within CI/CD pipelines, or in applications that dynamically generate and import the affected models.

References