This vulnerability occurs in the datamodel‑code‑generator tool, which transforms various data schema formats into Python code. When a schema defines a default_factory field, the generator preserves the provided expression and emits it directly into the generated Field(... ) or field(... ) constructor. This means that importing the generated module will evaluate the expression, enabling arbitrary Python code execution. The weakness is a classic code injection flaw, illustrated by CWE‑94, and a misuse of default_factory leading to unforeseen code running, classified as CWE‑1336. If the generated code is executed in a privileged context, the attacker can compromise confidentiality, integrity, or availability of the affected system.

The vulnerable product is datamodel-code-generator from koxudaxi. Versions 0.17.0 through 0.60.1 (inclusive) contain the flaw, as the issue was fixed in 0.60.2. No other vendors or product lines are affected. Users running the generator on untrusted schemas should treat these releases as vulnerable.

The CVSS score is 8.8, which places the vulnerability in the high severity range. However, the EPSS score is below 1 %, indicating a low probability of exploitation at present. The flaw is not in the CISA known‑exploited vulnerabilities list. The attack vector requires an attacker to supply a malicious schema to the code generator or influence the schema generation process. Once the bad schema is processed, any Python interpreter that imports the generated model will execute the injected expression, potentially allowing local code execution and, if the interpreter runs with elevated privileges, remote code execution. Because the vulnerability is discovered through the code generator, remediation by upgrading to the patched version is the most effective countermeasure.