Arbitrary Code Execution Vulnerability in DataModel Code Generator by Koxudaxi

CVE-2026-54655

What is CVE-2026-54655?

The DataModel Code Generator by Koxudaxi, which automates the generation of Python data models from schema definitions, has a vulnerability in the handling of x-python-type values within JSON Schema. Versions between 0.51.0 and 0.60.2 fail to properly validate these values, allowing an attacker to manipulate the JSON Schema content. When the generated module is imported, this can result in the execution of arbitrary Python code, potentially compromising the security of applications that utilize the affected version.

References