18620 matches found
Arbitrary Code Injection
Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the validators processing in the --extra-template-data file. An attacker can execute arbitrary code during module import by supplying specially crafted...
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @fieldvalidator... decorator from each entry. The field names and the validator mode are interpolated into the...
CVE-2026-54656
CVE-2026-54656 affects datamodel-code-generator (0.52.1–0.60.2). The issue arises when validators are interpolated from --extra-template-data into @field_validator decorators via _process_validators in src/datamodel_code_generator/model/pydantic_v2/base_model.py, enabling Python code execution up...
CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...
CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...
CVE-2026-54656 `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...
CVE-2026-54654
CVE-2026-54654 affects datamodel-code-generator (versions 0.14.1–0.60.2). The --extra-template-data comment field is rendered into Python comments in multiple templates without neutralizing carriage returns, allowing attacker-controlled comments to inject Python code into generated models that ex...
EUVD-2026-50067
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-54654
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060
Litestar (Python ASGI framework) is affected when using a template engine with CSRF protection configured inline with the templating docs. Prior to version 2.20.0, the csrftoken contents could be injected into rendered HTML due to a lack of escaping, enabling HTML injection and potential XSS. The...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
EUVD-2026-49994
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
