CVE-2026-54621

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54621", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T20:07:02.184Z", "datePublished": "2026-07-28T21:35:27.863Z", "dateUpdated": "2026-07-29T12:34:35.056Z"}, "containers": {"cna": {"title": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3"}, {"name": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988", "tags": ["x_refsource_MISC"], "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988"}, {"name": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1"}], "affected": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"version": ">= 0.25.0, < 0.60.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T21:35:27.863Z"}, "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1."}], "source": {"advisory": "GHSA-j884-q54q-mmx3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T12:34:28.223250Z", "id": "CVE-2026-54621", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:34:35.056Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54621", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T12:34:28.223250Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:34:31.575Z"}}], "cna": {"title": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description", "source": {"advisory": "GHSA-j884-q54q-mmx3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "koxudaxi", "product": "datamodel-code-generator", "versions": [{"status": "affected", "version": ">= 0.25.0, < 0.60.1"}]}], "references": [{"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3", "name": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988", "name": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1", "name": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T21:35:27.863Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54621", "state": "PUBLISHED", "dateUpdated": "2026-07-29T12:34:35.056Z", "dateReserved": "2026-06-15T20:07:02.184Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T21:35:27.863Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "datamodel-code-generator", "vendor": "koxudaxi", "versions": [{"status": "affected", "version": ">= 0.25.0, < 0.60.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1."}, {"lang": "es", "value": "datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Antes de la versi\u00f3n 0.60.1, los valores de descripci\u00f3n de uniones GraphQL en src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 y src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 se renderizan en comentarios de Python sin neutralizar los retornos de carro en los comentarios de Python #, lo que permite que el contenido de esquema GraphQL controlado por el atacante inyecte c\u00f3digo Python en los modelos generados que se ejecuta al ser importado. Este problema est\u00e1 solucionado en la versi\u00f3n 0.60.1."}], "id": "CVE-2026-54621", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54621", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T12:34:28.223250Z", "version": "2.0.3"}}]}, "published": "2026-07-28T22:17:39.930", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988"}, {"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.25.0,0.60.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "datamodel-code-generator", "source": "cna", "vendor": "koxudaxi"}, "product": "datamodel-code-generator", "vendor": "koxudaxi"}], "created": "2026-07-28T23:30:03.480579+00:00", "updated": "2026-08-03T14:15:05.546396+00:00", "vendors": ["koxudaxi", "koxudaxi$PRODUCT$datamodel-code-generator"]}