CVE-2026-54655

설명

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.

영향 제품·버전

제품 koxudaxi datamodel-code-generator

영향 버전 koxudaxi datamodel-code-generator >= >= 0.51.0, < 0.60.2

수정 버전 koxudaxi datamodel-code-generator · 수정 버전은 공급사 공식자료 확인 필요

기술 정보

CVSS 벡터 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE CWE-94