https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 14:44:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342358 EUVD-2026-342358 https://cve.radiocsirt.org/vuln/euvd-2026-342358 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54656 <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.</p> <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decorators without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported. This issue is fixed in version 0.60.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54656 https://cve.radiocsirt.org/vuln/ghsa-8m8r-38jm-f355 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `&#39;` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _process_validators(self) -&gt; None: validators = self.extra_template_data.get(&#34;validators&#34;) if not validators: return ... for validator in validators: fields = validator.get(&#34;fields&#34;) or [validator.get(&#34;field&#34;)] fields = [f for f in fields if f] if not fields: continue function_path: str = validator[&#34;function&#34;] function_name = function_path.rsplit(&#34;.&#34;, 1)[-1] mode = validator.get(&#34;mode&#34;, &#34;after&#34;) fields_str = &#34;, &#34;.join(f&#34;&#39;{f}&#39;&#34; for f in field…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `&#39;` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _process_validators(self) -&gt; None: validators = self.extra_template_data.get(&#34;validators&#34;) if not validators: return ... for validator in validators: fields = validator.get(&#34;fields&#34;) or [validator.get(&#34;field&#34;)] fields = [f for f in fields if f] if not fields: continue function_path: str = validator[&#34;function&#34;] function_name = function_path.rsplit(&#34;.&#34;, 1)[-1] mode = validator.get(&#34;mode&#34;, &#34;after&#34;) fields_str = &#34;, &#34;.join(f&#34;&#39;{f}&#39;&#34; for f in field…</p> https://cve.radiocsirt.org/vuln/ghsa-8m8r-38jm-f355 https://cve.radiocsirt.org/vuln/pysec-2026-3559 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `&#39;` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _process_validators(self) -&gt; None: validators = self.extra_template_data.get(&#34;validators&#34;) if not validators: return ... for validator in validators: fields = validator.get(&#34;fields&#34;) or [validator.get(&#34;field&#34;)] fields = [f for f in fields if f] if not fields: continue function_path: str = validator[&#34;function&#34;] function_name = function_path.rsplit(&#34;.&#34;, 1)[-1] mode = validator.get(&#34;mode&#34;, &#34;after&#34;) fields_str = &#34;, &#34;.join(f&#34;&#39;{f}&#39;&#34; for f in field…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data` file and synthesises a Pydantic `@field_validator(...)` decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in *unescaped* single quotes. A value containing `&#39;` breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the decorator. The expression is evaluated at class-definition time, i.e. the moment the developer imports the generated module. This is the same trust model as the recently-published GHSA-wjv6-jcfj-mf9r (extras-file comment injection) but the impact is full RCE rather than a docstring leak.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/model/pydantic_v2/base_model.py`, `_process_validators` (lines 405–449, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _process_validators(self) -&gt; None: validators = self.extra_template_data.get(&#34;validators&#34;) if not validators: return ... for validator in validators: fields = validator.get(&#34;fields&#34;) or [validator.get(&#34;field&#34;)] fields = [f for f in fields if f] if not fields: continue function_path: str = validator[&#34;function&#34;] function_name = function_path.rsplit(&#34;.&#34;, 1)[-1] mode = validator.get(&#34;mode&#34;, &#34;after&#34;) fields_str = &#34;, &#34;.join(f&#34;&#39;{f}&#39;&#34; for f in field…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3559