PYSEC-2026-3559 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @fieldvalidator... decorator from each entry. The field names and the validator mode are interpolated into the...

OPENSUSE-SU-2026:11424-1 python313-pydantic-2.13.4-2.1 on GA media

These are all security issues fixed in the python313-pydantic-2.13.4-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-54656

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @fieldvalidator... decorator from each entry. The field names and the validator mode are interpolated into the...

GHSA-8M8R-38JM-F355 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @fieldvalidator... decorator from each entry. The field names and the validator mode are interpolated into the...

PT-2026-65650

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @field validator... decorator from each entry. The field names and the validator mode are interpolated into the...