CyberRota Analysis
AI-GeneratedThe datamodel-code-generator tool, versions 0.17.0 to 0.60.2, is vulnerable to a security flaw that allows attacker-controlled default_factory values to be executed as Python expressions upon model import. This could lead to arbitrary code execution, posing a significant risk to any applications utilizing this tool for generating data models. Organizations using affected versions should prioritize upgrading to version 0.60.2 or later to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)