https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 12 Aug 2026 21:41:44 +0000 https://vulnerability.circl.lu/sighting/f5e032bb-9b10-4de8-a541-574cf3a9cbc6/export {"uuid": "f5e032bb-9b10-4de8-a541-574cf3a9cbc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54656", "type": "seen", "source": "https://gist.github.com/alon710/9d9829ba6ab40face903027898206e80", "content": "# CVE-2026-54656: CVE-2026-54656: Arbitrary Code Execution in datamodel-code-generator via Unescaped Validator Configurations\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54656\n\n## Summary\nCVE-2026-54656 is a high-severity arbitrary code execution vulnerability in the koxudaxi/datamodel-code-generator Python package. When processing validator metadata from external configuration files passed via the --extra-template-data argument, the code generator performs unescaped string interpolation into Pydantic v2 @field_validator decorators. This allows local attackers to construct malicious configuration files that inject arbitrary Python statements into generated models, executing code upon downstream import. This vulnerability has been resolved in version 0.60.2.\n\n## TL;DR\nUnescaped string formatting in Pydantic v2 validator generation enables arbitrary code execution at module import time when processing malicious configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Local\n- **CVSS v3.1**: 7.8 (High)\n- **Exploit Status**: poc\n- **Impact**: Arbitrary Code Execution\n- **Affected Range**: >= 0.52.1, < 0.60.2\n- **Patched Version**: 0.60.2\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: >= 0.52.1, < 0.60.2 (Fixed in: `0.60.2`)\n\n## Mitigation\n\n- Upgrade to version 0.60.2 or higher\n- Implement schema validation for configuration files passed to --extra-template-data\n- Isolate compilation steps within sandboxed CI/CD environments\n\n**Remediation Steps:**\n1. Audit existing code generation pipelines for datamodel-code-generator dependencies between versions 0.52.1 and 0.60.1\n2. Upgrade the datamodel-code-generator package in lockfiles or requirements definitions to 0.60.2\n3. Block or filter user-supplied configuration configurations that contain special characters, single quotes, or semi-colons under validator fields\n\n## References\n\n- [NVD - CVE-2026-54656](https://nvd.nist.gov/vuln/detail/CVE-2026-54656)\n- [GitHub Security Advisory GHSA-8m8r-38jm-f355](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355)\n- [datamodel-code-generator v0.60.2 Release Notes](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54656) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T13:32:26.616949Z"} {"uuid": "f5e032bb-9b10-4de8-a541-574cf3a9cbc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54656", "type": "seen", "source": "https://gist.github.com/alon710/9d9829ba6ab40face903027898206e80", "content": "# CVE-2026-54656: CVE-2026-54656: Arbitrary Code Execution in datamodel-code-generator via Unescaped Validator Configurations\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54656\n\n## Summary\nCVE-2026-54656 is a high-severity arbitrary code execution vulnerability in the koxudaxi/datamodel-code-generator Python package. When processing validator metadata from external configuration files passed via the --extra-template-data argument, the code generator performs unescaped string interpolation into Pydantic v2 @field_validator decorators. This allows local attackers to construct malicious configuration files that inject arbitrary Python statements into generated models, executing code upon downstream import. This vulnerability has been resolved in version 0.60.2.\n\n## TL;DR\nUnescaped string formatting in Pydantic v2 validator generation enables arbitrary code execution at module import time when processing malicious configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Local\n- **CVSS v3.1**: 7.8 (High)\n- **Exploit Status**: poc\n- **Impact**: Arbitrary Code Execution\n- **Affected Range**: >= 0.52.1, < 0.60.2\n- **Patched Version**: 0.60.2\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: >= 0.52.1, < 0.60.2 (Fixed in: `0.60.2`)\n\n## Mitigation\n\n- Upgrade to version 0.60.2 or higher\n- Implement schema validation for configuration files passed to --extra-template-data\n- Isolate compilation steps within sandboxed CI/CD environments\n\n**Remediation Steps:**\n1. Audit existing code generation pipelines for datamodel-code-generator dependencies between versions 0.52.1 and 0.60.1\n2. Upgrade the datamodel-code-generator package in lockfiles or requirements definitions to 0.60.2\n3. Block or filter user-supplied configuration configurations that contain special characters, single quotes, or semi-colons under validator fields\n\n## References\n\n- [NVD - CVE-2026-54656](https://nvd.nist.gov/vuln/detail/CVE-2026-54656)\n- [GitHub Security Advisory GHSA-8m8r-38jm-f355](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355)\n- [datamodel-code-generator v0.60.2 Release Notes](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54656) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T13:32:26.616949Z"} https://vulnerability.circl.lu/sighting/f5e032bb-9b10-4de8-a541-574cf3a9cbc6/export Wed, 29 Jul 2026 13:32:26 +0000 https://vulnerability.circl.lu/sighting/fd7399e3-ccfe-4685-b159-9c957d934f47/export {"uuid": "fd7399e3-ccfe-4685-b159-9c957d934f47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54656", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355", "content": "", "creation_timestamp": "2026-07-28T22:35:13.623528Z"} {"uuid": "fd7399e3-ccfe-4685-b159-9c957d934f47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54656", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355", "content": "", "creation_timestamp": "2026-07-28T22:35:13.623528Z"} https://vulnerability.circl.lu/sighting/fd7399e3-ccfe-4685-b159-9c957d934f47/export Tue, 28 Jul 2026 22:35:13 +0000