aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +115 more potentially affected by CVE-2026-54621 via datamodel-code-generator (>=0.25.1, <=0.59.1)

datamodel-code-generator PYPI version =0.25.1, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.1.0, =0.6.0 and more Source cves: CVE-2026-54621 Source advisory: MEND:CVE-2026-54621...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-54621

datamodel-code-generator is affected: before version 0.60.1, GraphQL Union description values in UnionTypeStatement templates are rendered into Python comments without neutralizing carriage returns, enabling attacker-controlled GraphQL schema content to inject Python code that executes upon impor...

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the x-python-type extension in JSON Schema processing. An attacker can execute arbitrary code by supplying a crafted JSON Schema that injects malicious...

agency-swarm (>=1.9.8, <=1.9.9), aigear (>=0.0.2, <=0.2.1) +34 more potentially affected by CVE-2026-54655 via datamodel-code-generator (>=0.51.0, <=0.59.1)

datamodel-code-generator PYPI version =0.51.0, =1.9.8, =0.0.2, =1.3.5, =0.3.1, =0.9.0, =0.7.6, =0.14.2, =0.3.2, =1.2.1, =8.1.2, =0.6.0, =2.5.1, =3.0.4 and more Source cves: CVE-2026-54655 Source advisory: OSV:GHSA-M34R-V34R-RF9Q...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-54655 via datamodel-code-generator (>=0.5.10, <=0.59.1)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54655 Source advisory: SNYK:PYTHON-DATAMODELCODEGENERATOR-18388120...

GHSA-M34R-V34R-RF9Q `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

agency-swarm (>=1.9.8, <=1.9.9), aigear (>=0.0.2, <=0.2.1) +34 more potentially affected by CVE-2026-54655 via datamodel-code-generator (>=0.51.0, <=0.59.1)

datamodel-code-generator PYPI version =0.51.0, =1.9.8, =0.0.2, =1.3.5, =0.3.1, =0.9.0, =0.7.6, =0.14.2, =0.3.2, =1.2.1, =8.1.2, =0.6.0, =2.5.1, =3.0.4 and more Source cves: CVE-2026-54655 Source advisory: GHSA-M34R-V34R-RF9Q...

CVE-2026-54655

Summary: datamodel-code-generator (Python) is vulnerable from versions 0.51.0 through 0.60.2 where x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are injected into generated field annotations without sufficient validation, allowing at...

EUVD-2026-50071

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

agency-swarm (>=1.9.8, <=1.9.9), aigear (>=0.0.2, <=0.2.1) +34 more potentially affected by CVE-2026-54655 via datamodel-code-generator (>=0.51.0, <=0.59.1)

datamodel-code-generator PYPI version =0.51.0, =1.9.8, =0.0.2, =1.3.5, =0.3.1, =0.9.0, =0.7.6, =0.14.2, =0.3.2, =1.2.1, =8.1.2, =0.6.0, =2.5.1, =3.0.4 and more Source cves: CVE-2026-54655 Source advisory: MEND:CVE-2026-54655...

CVE-2026-54655

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

GHSA-R5VV-FF45-PRP2 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Summary When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin host/port/scheme. Credentials that an operator scoped to a trusted...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55403 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55403 Source advisory: GHSA-R5VV-FF45-PRP2...

Exposure of Private Personal Information to an Unauthorized Actor

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the getbody function. An attacker can obtain sensitive authorization headers by causing a redirect to a differe...