datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_gener…

A code injection vulnerability exists in datamodel-code-generator versions 0.51.0 through 0.60.1. The library, which generates Python data models from schema definitions, fails to sufficiently validate x-python-type values parsed from JSON Schema files. Attacker-controlled JSON Schema content can insert malicious Python code into generated field annotations. This code executes when the generated module is imported, enabling arbitrary code execution. The vulnerable function is _get_python_type_override in src/datamodel_code_generator/parser/jsonschema.py. The vulnerability is classified as a supply chain risk since it affects code generation tooling. The issue was fixed in version 0.60.2. Developers using this tool to process untrusted schema files are at risk.