CVE-2026-54656: Arbitrary Code Execution in datamodel-code-generator via Unescaped Validator Configurations

CVE-2026-54656 is a high-severity code injection vulnerability (classified under CWE-94) in the Python library datamodel-code-generator. The package is widely utilized to compile raw schemas—such as OpenAPI specifications, JSON Schema definitions, and GraphQL configurations—into clean Python classes, primarily targeting the Pydantic data validation framework. The vulnerability is situated within the library's Pydantic v2 code generation module, specifically involving the processing of user-defined field validation rules.\n\nThe attack surface is exposed when the code generator processes supplemental field-level validation settings supplied via the --extra-template-data command-line argument. This argument accepts custom metadata formats containing validator parameters. If an attacker can control or supply a maliciously prepared configuration file, they can control the inputs evaluated during code emission.\n\nBecause the target platform lacks robust validation or escaping on these properties, arbitrary Python payloads can be injected directly into the structure of generated files. This architectural vulnerability means that code execution occurs automatically as soon as any downstream system imports or loads the newly generated Python modules. The flaw represents a substantial threat to automated build systems, continuous integration (CI) environments, and developer workstations that programmatically process untrusted schemas.

The root cause of CVE-2026-54656 resides in src/datamodel_code_generator/model/pydantic_v2/base_model.py within the _process_validators() method. This method is designed to parse customized validation settings under the validators block of the configuration mapping. It extracts metadata keys such as fields, field, function, and mode to build lists of validation instructions that are subsequently passed to a Jinja2 template representing Pydantic @field_validator class decorators.\n\nDuring processing, the method evaluates the fields list and constructs a string representation (fields_str) using a list comprehension over an f-string: fields_str = ", ".join(f"'{f}'" for f in fields). The application assumes that input values are basic string field identifiers, wrapping each in single quotes without any character validation or sanitization. Similarly, the validator execution mode is formatted directly via mode_str = f"mode='{mode}'" without verification against permitted Pydantic validation phases.\n\nThis implementation creates a classic code generation escape. If a string within the fields list or mode contains a single quote character ('), the literal boundary of the Python string is terminated inside the generated code. A comma can then be appended to introduce new function parameters, or arbitrary Python expressions can be written to execute payload logic directly within the decorator's argument evaluation context.

The vulnerable implementation in the _process_validators() function performs string joining via f-strings. Consider the key section of the vulnerable codebase:\n\npython\n# Vulnerable code block in base_model.py\ndef _process_validators(self) -> None:\n validators = self.extra_template_data.get(\"validators\")\n if not validators:\n return\n ...\n for validator in validators:\n fields = validator.get(\"fields\")\n # Unsafe f-string join without escaping\n fields_str = \", \".join(f\"'{f}'\" for f in fields)\n \n # Unsafe mode construct\n mode_str = f\"mode='{mode}'\"\n ...\n\n\nThe Jinja2 template renders these properties directly inside the class definition scope: @field_validator({{ fields_str }}, {{ mode_str }}). This direct inclusion permits the embedding of sub-expressions inside the decorator statement.\n\nTo remediate this issue, the maintainers implemented a multi-stage defensive strategy in commit a43d02906111a2fdcaf13ee5b62eb2da85376f19. First, they integrated a validation function normalize_validators() to parse inputs against structured schema models. Second, they replaced raw f-string interpolation with safe serialization using repr() and Python's string representation formats:\n\npython\n# Patched code block in base_model.py\n# The input data is processed through strong schema enforcement models\nfrom datamodel_code_generator.validators import normalize_validators\n\ndef _process_validators(self) -> None:\n self.extra_template_data.pop(\"prepared_validators\", None)\n validators = self.extra_template_data.get(\"validators\")\n if not validators:\n return\n\n # Enforce type, structural and identifier validation rules\n try:\n validators = normalize_validators(validators)\n except ValidationError as e:\n raise Error(f\"Invalid validators configuration: {format_validation_error(e)}\") from e\n ...\n for validator in validators:\n ...\n # Refactored to utilize safe string representation serializing\n fields_str = \", \".join(repr(f) for f in fields)\n \n # Uses Python format specifier '!r' which acts as repr()\n mode_str = f\"mode={mode!r}\"\n ...\n\n\nThis structural patch prevents injection. Any single quotes contained within the parameter values are correctly escaped as \\' during repr() evaluation, neutralizing the string breakout vector.

Exploitation of CVE-2026-54656 is local but can be weaponized in automated pipelines or client-side execution contexts. To trigger the flaw, an attacker must supply a malicious JSON or YAML configuration file via the --extra-template-data CLI parameter. There are three primary avenues for injection: field-level breakout, validation mode injection, and import-level injection.\n\nIn a field breakout scenario, an attacker modifies the configuration structure to inject Python execution primitives inside the string boundaries. An input structure targeting the field parameter might resemble the following:\n\njson\n{\n \"User\": {\n \"validators\": [\n {\n \"field\": \"name', __import__('os').system('touch /tmp/pwned'), 'email\",\n \"function\": \"myapp.validators.validate_name\"\n }\n ]\n }\n}\n\n\nDuring compilation, the generator writes the following line to the output Python model: @field_validator('name', __import__('os').system('touch /tmp/pwned'), 'email', mode='after'). When this generated file is loaded downstream (such as by an import statement or a test runner), the Python interpreter executes the __import__('os').system(...) command during module initialization, culminating in arbitrary command execution on the host environment.

The security impact of CVE-2026-54656 is assessed as high, with a CVSS v3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The local attack vector requires that a user or an automated agent execute the generator with a malicious input file and subsequently load the output Python module.\n\nBecause the payload executes at module-definition time upon import, it inherits the execution context and permissions of the executing process. This allows for compromise of confidentiality, integrity, and availability. In typical DevOps pipelines, the importing application may run with elevated privileges or hold environment secrets (such as API keys, cloud credentials, or database connection strings) that can be readily exfiltrated by a payload.\n\nWhile this CVE is not currently active in CISA's Known Exploited Vulnerabilities (KEV) catalog, the ease with which proof-of-concept payloads can be generated makes it a high risk for build pipelines processing third-party configurations.

The recommended remediation is to upgrade datamodel-code-generator to version 0.60.2 or later. This release enforces a rigid validation schema, requiring that validator modes conform to Pydantic-approved constants (before, after, wrap, plain) and verifying that target fields are valid Python identifiers.\n\nIf immediate software upgrade is not feasible, operational environments should apply strict input filtering on configuration files before ingestion. Implement schema checkers to verify that all elements under validators are clean alphanumeric sequences, specifically rejecting any files containing control characters, semicolons, or single quotes.\n\nAdditionally, isolate automated build processes that utilize datamodel-code-generator within containerized sandboxes. Restrict the network egress of these environments during runtime to prevent exfiltration of credentials if an injection is successfully processed.