The vulnerability allows an attacker to inject Python code through the x‑python‑type JSON‑Schema extension. When datamodel‑code‑generator parses the schema, the unchecked value is inserted into generated field annotations, causing arbitrary code to run when the resulting module is imported. This flaw maps to CWE‑94: Improper Control of Generation of Code via Dynamic Code Generation. The effect is the execution of attacker‑controlled code in the context of the process that imports the generated file, potentially leading to full system compromise if the generator is used in production services.

The affected product is datamodel‑code‑generator from koxudaxi. Vulnerability is present in versions 0.51.0 through 0.60.1. Version 0.60.2 and later include the fix.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious JSON Schema that includes a controlled x‑python‑type value, meaning the attack vector is local or occurs within a trusted environment where the generator is used. The flaw exists in versions from 0.51.0 through 0.60.1; it is fixed in 0.60.2. If the generator is used in an automated or production pipeline, an attacker who can modify the schema—such as through a repository commit, continuous integration pipeline, or an API that accepts user‑supplied schemas—can trigger code execution when the generated module is imported. Given the high impact and moderate likelihood when the generator is part of a deployment pipeline, systems using datamodel‑code‑generator in automated or production contexts should treat this as a critical risk.