CyberRota Analysis
AI-GeneratedThe vulnerability affects the datamodel-code-generator, specifically in versions 0.51.0 to 0.60.2, where insufficient validation of x-python-type values allows attacker-controlled JSON Schema content to execute arbitrary Python code upon module import. This poses a significant risk as it could lead to remote code execution, compromising the integrity and security of applications using the affected versions. Developers and organizations utilizing this tool should prioritize upgrading to version 0.60.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is imported. This issue is fixed in version 0.60.2.