CVE-2026-54621CWE-1336CWE-94code-injection

CVE-2026-54621

High · published July 29, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-29T02:17Z
References (3)
https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988 · [email protected]https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1 · [email protected]https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3 · [email protected]
EPSS history
Timeline
  • 28 JUL 21:35Z
    `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
    cvelistv5