The CVSS 7.8 on this CVE obscures more than it reveals. This is not a traditional vulnerability where an attacker exploits a running service — it's a supply-chain poisoning mechanism baked into the tool's design. The attack surface is the generation step itself, not a later exploitation of the output.
When --extra-template-data receives attacker-controlled content and routes it into @field_validator generation via _process_validators, the tool produces Python code that contains embedded malicious payloads. The victim is whoever imports that generated code — not the developer running the generator. This is a fundamental trust-model failure: the tool treated template data as internal configuration rather than untrusted input requiring sanitization at every code-generation boundary.
The vulnerability existed in versions 0.52.1 through 0.60.2. Patching to 0.60.2 closes the technical hole, but it does not regenerate the artifacts already produced during that window. If your pipeline ran this tool between those versions and committed the output, you have poisoned generated code sitting in your repos and possibly published to PyPI — code that will never self-heal simply because you upgraded the generator.
Your immediate actions: audit any generated Pydantic models committed between 2024 and the 0.60.2 release date for suspicious validator content. Treat any --extra-template-data usage as a security-sensitive input boundary — validate and escape anything passed through it before it reaches the generator. Check whether other template-to-output pathways in your code-generation tooling share this implicit trust assumption; the pattern suggests once one injection surface exists, the underlying assumption usually pervades the codebase.