datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JS…

CVE-2026-54653 affects datamodel-code-generator versions 0.17.0 through 0.60.2, a tool that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from various schema formats. The vulnerability exists in src/datamodel_code_generator/parser/jsonschema.py where attacker-controlled default_factory values are preserved through JsonSchemaObject.init and get_field_extras. These values are then emitted into Field(default_factory=...) or field(default_factory=...) calls in the generated code. When a user imports the generated model, the malicious Python expressions are executed, leading to arbitrary code execution. The attack vector requires an attacker to supply a crafted schema input to the code generator. The issue has been patched in version 0.60.2, and users are advised to upgrade immediately.