https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 05 Aug 2026 06:23:42 +0000 https://vulnerability.circl.lu/sighting/12c1db51-1426-41b5-a583-3c7a5a6a7b39/export {"uuid": "12c1db51-1426-41b5-a583-3c7a5a6a7b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54654", "type": "seen", "source": "https://gist.github.com/alon710/22ff7de2f68c39286e130a0c2981900e", "content": "# CVE-2026-54654: CVE-2026-54654: Python Code Injection in datamodel-code-generator via Comment Line-Break Escape\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54654\n\n## Summary\nA vulnerability in the datamodel-code-generator library allows for unauthenticated remote code execution when generating code from malicious or untrusted schema specifications. By embedding special physical line terminators, such as carriage returns, vertical tabs, or form feeds, within template values, an attacker can break out of inline Python comment boundaries. The generated output file subsequently contains un-commented python instructions that execute automatically during module import.\n\n## TL;DR\nA local code injection vulnerability exists in datamodel-code-generator versions prior to 0.60.2. Inadequate sanitization of line terminators in the comment metadata of schema templates allows attackers to inject arbitrary executable statements into generated Python code, which triggers code execution when the generated files are imported.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-1336\n- **Attack Vector**: Local (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n- **CVSS Severity Score**: 7.8 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **Primary Vulnerable Component**: Jinja2 template interpolation logic in koxudaxi/datamodel-code-generator\n- **Fix Version**: 0.60.2\n\n## Affected Systems\n\n- datamodel-code-generator versions starting from 0.14.1 up to (but not including) 0.60.2\n- **datamodel-code-generator**: >= 0.14.1, < 0.60.2 (Fixed in: `0.60.2`)\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.60.2 or higher to ensure inputs are properly sanitized.\n- Implement pre-processing scripts that scrub or reject carriage returns, vertical tabs, and form feeds from JSON metadata input before compiling files.\n- Avoid importing unverified generated models directly in production deployments without initial syntactic sanity checks or static scanning.\n\n**Remediation Steps:**\n1. Inspect requirements.txt, poetry.lock, or Pipfile configurations to detect vulnerable versions of the generator (< 0.60.2).\n2. Execute the package manager update command: pip install --upgrade \"datamodel-code-generator>=0.60.2\".\n3. Review any internal workflows that utilize absolute paths for custom templates, as these bypass default comment sanitization features and must be audited manually.\n\n## References\n\n- [GHSA-wjv6-jcfj-mf9r: Python Code Injection in datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r)\n- [Release 0.60.2: official patched update release details](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54654) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T09:32:26.834258Z"} {"uuid": "12c1db51-1426-41b5-a583-3c7a5a6a7b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54654", "type": "seen", "source": "https://gist.github.com/alon710/22ff7de2f68c39286e130a0c2981900e", "content": "# CVE-2026-54654: CVE-2026-54654: Python Code Injection in datamodel-code-generator via Comment Line-Break Escape\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54654\n\n## Summary\nA vulnerability in the datamodel-code-generator library allows for unauthenticated remote code execution when generating code from malicious or untrusted schema specifications. By embedding special physical line terminators, such as carriage returns, vertical tabs, or form feeds, within template values, an attacker can break out of inline Python comment boundaries. The generated output file subsequently contains un-commented python instructions that execute automatically during module import.\n\n## TL;DR\nA local code injection vulnerability exists in datamodel-code-generator versions prior to 0.60.2. Inadequate sanitization of line terminators in the comment metadata of schema templates allows attackers to inject arbitrary executable statements into generated Python code, which triggers code execution when the generated files are imported.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-1336\n- **Attack Vector**: Local (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n- **CVSS Severity Score**: 7.8 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **Primary Vulnerable Component**: Jinja2 template interpolation logic in koxudaxi/datamodel-code-generator\n- **Fix Version**: 0.60.2\n\n## Affected Systems\n\n- datamodel-code-generator versions starting from 0.14.1 up to (but not including) 0.60.2\n- **datamodel-code-generator**: >= 0.14.1, < 0.60.2 (Fixed in: `0.60.2`)\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.60.2 or higher to ensure inputs are properly sanitized.\n- Implement pre-processing scripts that scrub or reject carriage returns, vertical tabs, and form feeds from JSON metadata input before compiling files.\n- Avoid importing unverified generated models directly in production deployments without initial syntactic sanity checks or static scanning.\n\n**Remediation Steps:**\n1. Inspect requirements.txt, poetry.lock, or Pipfile configurations to detect vulnerable versions of the generator (< 0.60.2).\n2. Execute the package manager update command: pip install --upgrade \"datamodel-code-generator>=0.60.2\".\n3. Review any internal workflows that utilize absolute paths for custom templates, as these bypass default comment sanitization features and must be audited manually.\n\n## References\n\n- [GHSA-wjv6-jcfj-mf9r: Python Code Injection in datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r)\n- [Release 0.60.2: official patched update release details](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54654) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T09:32:26.834258Z"} https://vulnerability.circl.lu/sighting/12c1db51-1426-41b5-a583-3c7a5a6a7b39/export Wed, 29 Jul 2026 09:32:26 +0000 https://vulnerability.circl.lu/sighting/2b7f5726-45c5-4a97-a730-8f5c8ba65fa0/export {"uuid": "2b7f5726-45c5-4a97-a730-8f5c8ba65fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54654", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrqy7iat4v2y", "content": "datamodel-code-generator 0.14.1\u304b\u30890.60.2\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306f\u3001\u30b3\u30e1\u30f3\u30c8\u5185\u306e\u6539\u884c\u7121\u52b9\u5316\u306b\u3088\u308a\u3001Python\u30b3\u30fc\u30c9\u304c\u751f\u6210\u30e2\u30c7\u30eb\u306b\u633f\u5165\u3055\u308c\u3001\u30a4\u30f3\u30dd\u30fc\u30c8\u6642\u306b\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027\u2026\nCVE-2026-54654 CVSS 7.8 | HIGH", "creation_timestamp": "2026-07-29T03:28:01.658200Z"} {"uuid": "2b7f5726-45c5-4a97-a730-8f5c8ba65fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54654", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrqy7iat4v2y", "content": "datamodel-code-generator 0.14.1\u304b\u30890.60.2\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306f\u3001\u30b3\u30e1\u30f3\u30c8\u5185\u306e\u6539\u884c\u7121\u52b9\u5316\u306b\u3088\u308a\u3001Python\u30b3\u30fc\u30c9\u304c\u751f\u6210\u30e2\u30c7\u30eb\u306b\u633f\u5165\u3055\u308c\u3001\u30a4\u30f3\u30dd\u30fc\u30c8\u6642\u306b\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027\u2026\nCVE-2026-54654 CVSS 7.8 | HIGH", "creation_timestamp": "2026-07-29T03:28:01.658200Z"} https://vulnerability.circl.lu/sighting/2b7f5726-45c5-4a97-a730-8f5c8ba65fa0/export Wed, 29 Jul 2026 03:28:01 +0000 https://vulnerability.circl.lu/sighting/0cc9263d-e43a-4f20-ab77-a1f9bf078b7c/export {"uuid": "0cc9263d-e43a-4f20-ab77-a1f9bf078b7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54654", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r", "content": "", "creation_timestamp": "2026-07-28T22:35:44.363508Z"} {"uuid": "0cc9263d-e43a-4f20-ab77-a1f9bf078b7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54654", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r", "content": "", "creation_timestamp": "2026-07-28T22:35:44.363508Z"} https://vulnerability.circl.lu/sighting/0cc9263d-e43a-4f20-ab77-a1f9bf078b7c/export Tue, 28 Jul 2026 22:35:44 +0000