CVE-2026-54656 affects datamodel-code-generator versions 0.52.1 through 0.60.2, a tool that generates Pydantic v2 models and other data structures from various schema formats. The vulnerability exists in src/datamodel_code_generator/model/pydantic_v2/base_model.py where the _process_validators function interpolates user-supplied validators from the --extra-template-data argument into @field_validator decorators without safe validation. This allows an attacker to inject arbitrary Python code into generated model files. The malicious code executes when the generated Pydantic v2 model is imported into a Python application. This is a code injection vulnerability in a developer toolchain component, posing a supply chain risk. The issue has been fixed in version 0.60.2 of datamodel-code-generator. Developers using affected versions should upgrade immediately to mitigate the risk.