`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Summary

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "default_factory" key, its value is interpolated verbatim — as a raw Python expression — into the generated Field(default_factory=...) / field(default_factory=...) call. Because this assignment is evaluated at class-definition time (i.e. on import of the generated module), an attacker who controls the schema controls a Python expression that runs in the consumer's process. No special CLI flags are required.

Details

The vulnerable chain spans the JSON-Schema-shaped parser and three sink locations (Pydantic v2, dataclass, msgspec):

Source — schema → extras:

• src/datamodel_code_generator/parser/jsonschema.py:600-614 — DEFAULT_FIELD_KEYS includes the literal string "default_factory".
• src/datamodel_code_generator/parser/jsonschema.py:457-459 — JsonSchemaObject.__init__ stores any non-standard key (including default_factory) in self.extras.
• src/datamodel_code_generator/parser/jsonschema.py:797-812 — get_field_extras preserves default_factory through to the field model.

Sinks — extras → generated Python expression:

1. src/datamodel_code_generator/model/pydantic_base.py:222-249:

   default_factory = data.pop("default_factory", None)
   ...
   if default_factory is not None:
       field_arguments = [f"default_factory={default_factory}", *field_arguments]
   

   The default_factory value is interpolated raw (no repr(), no validation).

2. src/datamodel_code_generator/model/dataclass.py:211:

   f"{k}={v if k == 'default_factory' else repr(v)}"
   

   Explicit special-case to skip repr() for default_factory.

3. src/datamodel_code_generator/model/msgspec.py:361 — same pattern as dataclass.

Because default_factory is in DEFAULT_FIELD_KEYS, no special CLI flag is needed to reach the sink. Any input format that uses the JSON-Schema-shaped parser (, , , , , ) — and any input format that converts to it (, , ) — is in scope.