Summary
A code injection flaw in datamodel-code-generator allows attacker-controlled JSON Schema attributes to be inserted directly into generated Python type annotations.
When such a generated module is imported, the embedded Python expressions may be executed, making schema-driven workflows risky if schemas are not fully trusted.
A code injection flaw in datamodel-code-generator allows attacker-controlled JSON Schema attributes to be inserted directly into generated Python type annotations.
When such a generated module is imported, the embedded Python expressions may be executed, making schema-driven workflows risky if schemas are not fully trusted.
Affected context
This vulnerability appears in environments that use datamodel-code-generator to automatically generate Python models from JSON Schema or similar specifications.
It becomes relevant when:
- Schemas are obtained from external or semi-trusted sources (e.g., user uploads, partner APIs, shared repositories)
- The generator processes
x-python-typeextensions without strict validation - Generated modules are imported into application code, tooling, or pipelines
In tightly controlled, fully trusted schema authoring workflows, the practical risk may be lower but still warrants review.
This vulnerability appears in environments that use datamodel-code-generator to automatically generate Python models from JSON Schema or similar specifications.
It becomes relevant when:
- Schemas are obtained from external or semi-trusted sources (e.g., user uploads, partner APIs, shared repositories)
- The generator processes
x-python-typeextensions without strict validation - Generated modules are imported into application code, tooling, or pipelines
In tightly controlled, fully trusted schema authoring workflows, the practical risk may be lower but still warrants review.
Exploit preconditions
- Attack surface: JSON Schema or similar input consumed by datamodel-code-generator
- Required access: Ability to provide or modify schema content that the generator will process (e.g., commit rights, upload capability, or control of an API supplying schemas)
- Trigger point: Running datamodel-code-generator on the malicious schema and then importing the resulting Python module
- Why exploitation is possible: The
_get_python_type_overridelogic insertsx-python-typevalues directly into field annotations without adequate validation or sanitization, allowing arbitrary Python expressions to be evaluated during import.
- Attack surface: JSON Schema or similar input consumed by datamodel-code-generator
- Required access: Ability to provide or modify schema content that the generator will process (e.g., commit rights, upload capability, or control of an API supplying schemas)
- Trigger point: Running datamodel-code-generator on the malicious schema and then importing the resulting Python module
- Why exploitation is possible: The
_get_python_type_overridelogic insertsx-python-typevalues directly into field annotations without adequate validation or sanitization, allowing arbitrary Python expressions to be evaluated during import.
Why this happens
The underlying issue is a direct trust of schema-provided type override metadata as executable Python code.
In jsonschema.py, _get_python_type_override treats x-python-type as a safe directive and embeds its value into generated annotations, effectively creating code from data.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), where untrusted input is allowed to influence code structure and behavior without enforcement of a safe subset or strict validation.
The underlying issue is a direct trust of schema-provided type override metadata as executable Python code.
In jsonschema.py, _get_python_type_override treats x-python-type as a safe directive and embeds its value into generated annotations, effectively creating code from data.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), where untrusted input is allowed to influence code structure and behavior without enforcement of a safe subset or strict validation.
Potential impact
- Arbitrary code execution when importing generated Python modules
- Compromise of build or generation environments (CI/CD runners, developer workstations)
- Installation of backdoors or data exfiltration logic in application code
- Tampering with business logic or security controls through poisoned models
- Lateral movement from the generation pipeline into connected systems or services
- Arbitrary code execution when importing generated Python modules
- Compromise of build or generation environments (CI/CD runners, developer workstations)
- Installation of backdoors or data exfiltration logic in application code
- Tampering with business logic or security controls through poisoned models
- Lateral movement from the generation pipeline into connected systems or services
General mitigation guidance
Effective mitigation focuses on reducing trust in schema-driven code generation and constraining what can influence generated code.
Typical strategies include:
- Treating all external schemas as untrusted input and avoiding direct embedding of extension fields into executable code
- Limiting or removing support for arbitrary code-bearing extensions such as
x-python-type, or strictly validating them against a conservative allowlist of safe constructs - Separating code generation environments from production systems and running generators with least privilege
- Introducing a review and approval process for schemas that can influence model generation in shared repositories
- Favoring declarative, non-executable metadata in schemas instead of extension fields that are interpreted as Python expressions
Effective mitigation focuses on reducing trust in schema-driven code generation and constraining what can influence generated code.
Typical strategies include:
- Treating all external schemas as untrusted input and avoiding direct embedding of extension fields into executable code
- Limiting or removing support for arbitrary code-bearing extensions such as
x-python-type, or strictly validating them against a conservative allowlist of safe constructs - Separating code generation environments from production systems and running generators with least privilege
- Introducing a review and approval process for schemas that can influence model generation in shared repositories
- Favoring declarative, non-executable metadata in schemas instead of extension fields that are interpreted as Python expressions
How teams detect issues like this
Detection can rely on both code-level and workflow-focused controls:
- Static analysis or linting rules that flag dynamic code generation patterns and direct insertion of user-controlled strings into type annotations or executable contexts
- Targeted scans of generated code for suspicious constructs, such as unexpected function calls, imports, or arbitrary expressions in annotations originating from schema metadata
- Code review practices that require inspection of changes to schema files, especially fields like
x-python-typeor other custom extensions that influence generation - CI policies that restrict or warn on use of extension fields and enforce a schema validation step before generation
- Optional use of automated security review tools integrated with the generation pipeline to catch unsafe patterns early
Detection can rely on both code-level and workflow-focused controls:
- Static analysis or linting rules that flag dynamic code generation patterns and direct insertion of user-controlled strings into type annotations or executable contexts
- Targeted scans of generated code for suspicious constructs, such as unexpected function calls, imports, or arbitrary expressions in annotations originating from schema metadata
- Code review practices that require inspection of changes to schema files, especially fields like
x-python-typeor other custom extensions that influence generation - CI policies that restrict or warn on use of extension fields and enforce a schema validation step before generation
- Optional use of automated security review tools integrated with the generation pipeline to catch unsafe patterns early
