datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.

Affected: PyPI: datamodel-code-generator

### Summary

When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `'` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.

### Details

Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):

```python def _process_validators(self) -> None: validators = self.extra_template_data.get("validators") if not validators: return ... for validator in validators: fields = validator.get("fields") or [validator.get("field")] fields = [f for f in fields if f] if not fields: continue function_path: str = validator["function"] function_name = function_path.rsplit(".", 1)[-1] mode = validator.get("mode", "after") fields_str = ", ".join(f"'{f}'" for f in field…

Affected: PyPI: datamodel-code-generator

### Summary

When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `'` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.

### Details

Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):

```python def _process_validators(self) -> None: validators = self.extra_template_data.get("validators") if not validators: return ... for validator in validators: fields = validator.get("fields") or [validator.get("field")] fields = [f for f in fields if f] if not fields: continue function_path: str = validator["function"] function_name = function_path.rsplit(".", 1)[-1] mode = validator.get("mode", "after") fields_str = ", ".join(f"'{f}'" for f in field…