PT-2026-65606 · Pypi · Datamodel-Code-Generator

CVE-2026-54654 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1

Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return (r). The software renders this comment variable into Python comments within several templates without neutralizing line terminators. Because the Python tokenizer treats a carriage return as a physical-line terminator, the comment is prematurely ended, allowing subsequent text to be parsed and executed as Python code when the generated models are imported. This can lead to arbitrary code execution in the process of the importer.

Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later. As a temporary mitigation, avoid using the --extra-template-data flag or ensure that the comment values in the extras file do not contain carriage returns (r), vertical tabs (x0b), or form feeds (x0c).

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2026-54654

GHSA-WJV6-JCFJ-MF9R

Affected Products

Datamodel-Code-Generator

References · 6

• https://osv.dev/vulnerability/GHSA-wjv6-jcfj-mf9r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54654 · Security Note
• https://github.com/koxudaxi/datamodel-code-generator/commit/b73abb5cd703a50471b8950bbd3bd0b82ad71de7 · Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note