{"action":"Upgrade datamodel-code-generator to 0.60.2 or later.","affected":[{"fixed":"0.60.2","introduced":"0.17.0"}],"component":"datamodel-code-generator","cve_ids":["CVE-2026-54653"],"ecosystem":"PyPI","epss":0.00711,"exploited":false,"fixed_versions":["0.60.2"],"ghsa_id":"GHSA-386q-5hp3-95m9","id":"tcs_01M5KEV98YHREXTEG1K7A8DABV","modified_at":"2026-09-10T03:51:09.992619034Z","published_at":"2026-07-28T21:48:14Z","references":["https://osv.dev/vulnerability/GHSA-386q-5hp3-95m9","https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9","https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1d","https://github.com/koxudaxi/datamodel-code-generator","https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-386q-5hp3-95m9","url":"https://osv.dev/vulnerability/GHSA-386q-5hp3-95m9"}],"summary":"`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field"}