Summary
A code injection flaw in datamodel-code-generator allows attacker-controlled template data to be interpolated directly into generated @field_validator decorators without safe validation.
If an attacker can influence --extra-template-data used for generating Pydantic v2 models, arbitrary Python code may execute as soon as the generated models are imported.
A code injection flaw in datamodel-code-generator allows attacker-controlled template data to be interpolated directly into generated @field_validator decorators without safe validation.
If an attacker can influence --extra-template-data used for generating Pydantic v2 models, arbitrary Python code may execute as soon as the generated models are imported.
Affected context
This vulnerability arises in environments that:
- Use datamodel-code-generator between versions 0.52.1 and 0.60.2
- Generate Pydantic v2 models using templates that consume
--extra-template-data - Treat generated code as trusted and import it into application runtimes
The risk is higher in build or generation pipelines where template data is dynamically sourced, shared among teams, or derived from partially untrusted configuration.
This vulnerability arises in environments that:
- Use datamodel-code-generator between versions 0.52.1 and 0.60.2
- Generate Pydantic v2 models using templates that consume
--extra-template-data - Treat generated code as trusted and import it into application runtimes
The risk is higher in build or generation pipelines where template data is dynamically sourced, shared among teams, or derived from partially untrusted configuration.
Exploit preconditions
- Attack surface: Code generation pipeline for Pydantic v2 models (CLI or programmatic use of datamodel-code-generator).
- Required access: Ability to control or modify values passed via
--extra-template-data, or equivalent template data sources. - Trigger point: Importing the generated Python module containing the interpolated
@field_validatorcode. - Why exploitation is possible: The generator interpolates template data into validator definitions without sanitization or structural checks, enabling direct injection of arbitrary Python expressions or statements into the generated source.
- Attack surface: Code generation pipeline for Pydantic v2 models (CLI or programmatic use of datamodel-code-generator).
- Required access: Ability to control or modify values passed via
--extra-template-data, or equivalent template data sources. - Trigger point: Importing the generated Python module containing the interpolated
@field_validatorcode. - Why exploitation is possible: The generator interpolates template data into validator definitions without sanitization or structural checks, enabling direct injection of arbitrary Python expressions or statements into the generated source.
Why this happens
The root cause is template-driven code generation that treats external template data as trusted source code.
In base_model.py, --extra-template-data is processed via _process_validators and inserted into @field_validator decorators without constraining content to a safe subset or performing structural validation.
This matches CWE-94: Improper Control of Generation of Code, where dynamically constructed code is built from inputs that are not validated or escaped, allowing attackers to introduce arbitrary instructions into the generated program.
The root cause is template-driven code generation that treats external template data as trusted source code.
In base_model.py, --extra-template-data is processed via _process_validators and inserted into @field_validator decorators without constraining content to a safe subset or performing structural validation.
This matches CWE-94: Improper Control of Generation of Code, where dynamically constructed code is built from inputs that are not validated or escaped, allowing attackers to introduce arbitrary instructions into the generated program.
Potential impact
- Arbitrary Python code execution when the generated models are imported
- Compromise of build agents or CI/CD runners that generate and test models
- Access to sensitive data available in the model-consuming application environment (secrets, tokens, configuration)
- Lateral movement within development or production infrastructure where generated code is deployed
- Supply-chain style compromise by poisoning shared model packages or SDKs
- Arbitrary Python code execution when the generated models are imported
- Compromise of build agents or CI/CD runners that generate and test models
- Access to sensitive data available in the model-consuming application environment (secrets, tokens, configuration)
- Lateral movement within development or production infrastructure where generated code is deployed
- Supply-chain style compromise by poisoning shared model packages or SDKs
General mitigation guidance
Effective mitigation focuses on tightening how template data is handled and reducing trust in generated code:
- Restrict or eliminate the use of free-form code constructs in template parameters such as
--extra-template-data; prefer structured, declarative values that templates transform in controlled ways. - Introduce strict validation and whitelisting for any data that influences generated decorators or executable code segments, ensuring only expected patterns are permitted.
- Treat generated code as untrusted until it passes automated checks (linting, static analysis, security review) and is committed under version control.
- Isolate code generation and subsequent imports in least-privilege environments, limiting filesystem, network, and secret access where generated models are first executed.
- Adopt secure-by-default templates that do not directly embed raw user-provided expressions into decorators or other executable constructs.
Effective mitigation focuses on tightening how template data is handled and reducing trust in generated code:
- Restrict or eliminate the use of free-form code constructs in template parameters such as
--extra-template-data; prefer structured, declarative values that templates transform in controlled ways. - Introduce strict validation and whitelisting for any data that influences generated decorators or executable code segments, ensuring only expected patterns are permitted.
- Treat generated code as untrusted until it passes automated checks (linting, static analysis, security review) and is committed under version control.
- Isolate code generation and subsequent imports in least-privilege environments, limiting filesystem, network, and secret access where generated models are first executed.
- Adopt secure-by-default templates that do not directly embed raw user-provided expressions into decorators or other executable constructs.
How teams detect issues like this
Detection generally combines code inspection and pipeline safeguards:
- Use static analysis or pattern-based searches to flag generated code where
@field_validatoror similar decorators contain suspicious or non-declarative expressions sourced from template data. - Review code generation templates and configuration for locations where external inputs are concatenated into Python source without escaping or structural checks.
- Enforce CI policies that block or alert on dynamically generated files containing imports, OS interaction calls, or other high-risk APIs that are not expected in model definitions.
- Incorporate automated security review tools that scan both source templates and generated artifacts, treating generation outputs as first-class code subject to the same standards as hand-written modules.
Detection generally combines code inspection and pipeline safeguards:
- Use static analysis or pattern-based searches to flag generated code where
@field_validatoror similar decorators contain suspicious or non-declarative expressions sourced from template data. - Review code generation templates and configuration for locations where external inputs are concatenated into Python source without escaping or structural checks.
- Enforce CI policies that block or alert on dynamically generated files containing imports, OS interaction calls, or other high-risk APIs that are not expected in model definitions.
- Incorporate automated security review tools that scan both source templates and generated artifacts, treating generation outputs as first-class code subject to the same standards as hand-written modules.
