{"vulnerability": "cve-2026-54653", "sightings": [{"uuid": "48c9ea06-3d60-46f6-9e3b-4c6dee21506b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54653", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9", "content": "", "creation_timestamp": "2026-07-28T22:35:08.665417Z"}, {"uuid": "72c49b99-197b-480c-a2fd-5ed5d49cf780", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54653", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqlhcj5h62q", "content": "CVE-2026-54653 - `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field\nCVE ID : CVE-2026-54653\n \n Published : July 28, 2026, 10:17 p.m. | 20\u00a0minutes ago\n \n Description : datamodel-code-generator generates Pydantic v2 ...", "creation_timestamp": "2026-07-28T23:39:45.494427Z"}, {"uuid": "b7d83227-df3a-4a06-873a-b40c8ec1ed83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54653", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrqy5oivvq2w", "content": "datamodel-code-generator 0.17.0\uff5e0.60.2\u3067\u3001\u5165\u529b\u3055\u308c\u305f\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u304cPython\u30b3\u30fc\u30c9\u3068\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027\u3002\u751f\u6210\u3055\u308c\u305f\u30e2\u30c7\u30eb\u306e\u30a4\u30f3\u30dd\u30fc\u30c8\u6642\u306b\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u304c\u2026\nCVE-2026-54653 CVSS 8.8 | HIGH", "creation_timestamp": "2026-07-29T03:27:01.999960Z"}, {"uuid": "414979be-3910-42a3-b464-c1d03ce65d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54653", "type": "seen", "source": "https://gist.github.com/alon710/18c642199d3d87ef43a0391f4cc215a6", "content": "# CVE-2026-54653: CVE-2026-54653: Remote Code Execution via Code Injection in datamodel-code-generator\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54653\n\n## Summary\nA critical code injection vulnerability exists in datamodel-code-generator from version 0.17.0 up to 0.60.1. The vulnerability allows remote attackers who supply a malicious JSON schema to execute arbitrary Python code. This occurs when the schema specifies a payload inside the 'default_factory' field extra, which is rendered directly into generated code without sanitization. When downstream processes load or import the output code, the evaluation of the class definition immediately triggers the execution of the injected code.\n\n## TL;DR\nUnsanitized rendering of the 'default_factory' schema parameter allows unauthenticated remote attackers to inject arbitrary Python expressions, resulting in automatic code execution when downstream applications import the generated code.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.8\n- **Exploit Status**: Proof-of-Concept\n- **Impact**: Arbitrary Code Execution (RCE)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: >= 0.17.0, < 0.60.2 (Fixed in: `0.60.2`)\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.60.2 or later.\n- Implement automated validation on JSON schemas to reject unexpected patterns in the default_factory property.\n- Isolate the model compilation process in an unprivileged runtime container with restricted system access.\n\n**Remediation Steps:**\n1. Check current datamodel-code-generator dependency version.\n2. Run pip install --upgrade datamodel-code-generator>=0.60.2 to install the security patch.\n3. Audit pipeline configuration and restrict network access during automated module generation.\n4. Establish static analysis scanners to inspect generated python files for suspicious imports or function executions before production usage.\n\n## References\n\n- [GitHub Security Advisory (GHSA-386q-5hp3-95m9)](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9)\n- [Vulnerability Patch Commit](https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1d)\n- [Official v0.60.2 Release Details](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)\n- [CVE-2026-54653 Official Record](https://www.cve.org/CVERecord?id=CVE-2026-54653)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54653) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T11:31:22.607334Z"}]}