The vulnerability in datamodel-code-generator allows arbitrary Python code to be executed when a generated Pydantic v2 model is imported. The flaw stems from the interpolation of validators supplied via the --extra-template-data option; the tool places these raw strings into @field_validator decorators without escaping. As a result, an attacker who can influence the content of the validators can inject and run malicious code during import of the generated model, compromising the confidentiality, integrity, and availability of the runtime environment.

The issue affects versions 0.52.1 through 0.60.2 of datamodel-code-generator from the vendor koxudaxi. Any environment that uses these versions and generates Pydantic v2 models from external schemas with the --extra-template-data flag is potentially impacted.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low but non-zero probability of exploitation at the time of this assessment. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to supply custom validators via the command line or configuration file; the code then runs when the generated module is imported, making the attack vector a trusted-code module import scenario.