CVE-2025-69201: Pydantic Unvalidated Command List Field

Pydantic BaseModel declares a `command: list[str]` field with no `@field_validator("command")`. If this list is forwarded to a subprocess/docker/shell sink (e.g. concatenated with a docker binary path and executed via python_on_whales, subprocess, os.system, etc.), an attacker controlling the request body can inject arbitrary command-line arguments and subco

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Python
greprules fetch cve-2025-69201-pydantic-unvalidated-command-list-field --engine opengrep

Description

Pydantic BaseModel declares a `command: list[str]` field with no `@field_validator("command")`. If this list is forwarded to a subprocess/docker/shell sink (e.g. concatenated with a docker binary path and executed via python_on_whales, subprocess, os.system, etc.), an attacker controlling the request body can inject arbitrary command-line arguments and subco