PT-2026-65608 · Pypi · Datamodel-Code-Generator

CVE-2026-54621 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0

Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into Python comments within the templates src/datamodel code generator/model/template/UnionTypeStatement.jinja2, src/datamodel code generator/model/template/UnionTypeAliasAnnotation.jinja2, and src/datamodel code generator/model/template/UnionTypeAliasType.jinja2.

A Jinja2 filter only handles characters, failing to neutralize carriage returns (r). Because Python's tokenizer treats a bare carriage return as a physical-line terminator, the comment is terminated prematurely, allowing subsequent text to be parsed and executed as module-level Python code when the generated model is imported. This affects regular-string form descriptions where r escapes are preserved by graphql-core and passed to the description variable.

Recommendations Update datamodel-code-generator to version 0.60.1 or later.

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2026-54621

GHSA-J884-Q54Q-MMX3

Affected Products

Datamodel-Code-Generator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54621 · Security Note
• https://osv.dev/vulnerability/GHSA-j884-q54q-mmx3 · Vendor Advisory
• https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988 · Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3 · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note