CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Antes de la versión 0.60.1, los valores de descripción de uniones GraphQL en src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 y src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 se renderizan en comentarios de Python sin neutralizar los retornos de carro en los comentarios de Python #, lo que permite que el contenido de esquema GraphQL controlado por el atacante inyecte código Python en los modelos generados que se ejecuta al ser importado. Este problema está solucionado en la versión 0.60.1.

Information

Published : 2026-07-28 22:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54621

Mitre link : CVE-2026-54621

CVE.ORG link : CVE-2026-54621

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-54621", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54621", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T12:34:28.223250Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"status": "affected", "version": ">= 0.25.0, < 0.60.1"}]}]}], "published": "2026-07-28T22:17:39.930", "references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988", "source": "security-advisories@github.com"}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1."}, {"lang": "es", "value": "datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Antes de la versi\u00f3n 0.60.1, los valores de descripci\u00f3n de uniones GraphQL en src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 y src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 se renderizan en comentarios de Python sin neutralizar los retornos de carro en los comentarios de Python #, lo que permite que el contenido de esquema GraphQL controlado por el atacante inyecte c\u00f3digo Python en los modelos generados que se ejecuta al ser importado. Este problema est\u00e1 solucionado en la versi\u00f3n 0.60.1."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}