`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

GHSA-M34R-V34R-RF9Q `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

EUVD-2026-50071

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655

Summary: datamodel-code-generator (Python) is vulnerable from versions 0.51.0 through 0.60.2 where x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are injected into generated field annotations without sufficient validation, allowing at...

CVE-2026-55403

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

CVE-2026-54654

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

Security update for python-urllib3

This update for python-urllib3 fixes the following issue CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3397-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE CVE-2026-43871

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Improper Authentication

Overview pytonapi is a Python SDK for TONAPI — REST API, streaming, and webhooks for TON blockchain. Affected versions of this package are vulnerable to Improper Authentication in the TonapiWebhookDispatcher process when a webhook handler is registered with a custom path argument. An attacker can...

CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

K000162114: Python urllib3 vulnerability CVE-2025-66418

Security Advisory Description urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps, leading to...

Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.

Summary IBM Maximo Application Suite uses pythondotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a...

CVE-2026-4360

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

CVE-2026-66138

A vulnerability was found in Ironic-Python-Agent's IPA time syncing code. The value of the ntpserver configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root...

CVE-2026-66053

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...