GHSA-J884-Q54Q-MMX3
Vulnerability from github – Published: 2026-07-28 21:35 – Updated: 2026-07-28 21:35Summary
datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("...") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is parsed as module-level Python. The injected code executes at import time of the generated .py, in the context of any consumer that imports the model. No special CLI flags are required.
This affects versions >=0.25.0, <0.60.1 and is fixed in 0.60.1.
Details
The vulnerable output was generated by the GraphQL Union templates:
src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2
Before 0.60.1, Union descriptions were rendered as Python comments using logic equivalent to # {{ description | replace('\n', '\n# ') }}.
The Jinja2 replace filter handled \n, but bare \r was not normalized. Python's lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.
The description value reaches Union generation from graphql-core through description=union_object.description. GraphQL regular string values can contain \r escapes, and graphql-core preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.
Impact
An attacker who can provide or influence a GraphQL schema processed by datamodel-code-generator could cause arbitrary Python code to be generated into the output file. That code would execute with the privileges of the process importing the generated model.
This can affect developers, CI pipelines, or applications that run datamodel-codegen --input-file-type graphql on untrusted or third-party GraphQL schemas and then import the generated Python module.
No custom templates, special CLI flags, or remote reference options are required.
Remediation
Upgrade to datamodel-code-generator 0.60.1 or later.
The fix normalizes carriage returns in GraphQL Union descriptions before rendering them as Python comments, so injected text remains inside the comment block.
Resolution
The fix applies comment_safe to GraphQL Union descriptions before template rendering. It normalizes CRLF and bare CR to LF so the existing Union comment templates keep the whole description inside the generated Python comment block.
Submitted by: Hamza Haroon (thegr1ffyn)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "datamodel-code-generator"
},
"ranges": [
{
"events": [
{
"introduced": "0.25.0"
},
{
"fixed": "0.60.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54621"
],
"database_specific": {
"cwe_ids": [
"CWE-94",
"CWE-1336"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-28T21:35:49Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\n`datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form (`\"...\"`) with a literal `\\r` escape, is rendered into a Python `#` comment by a Jinja2 filter that handles only `\\n`. Python\u0027s tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the `\\r` and the text after it is parsed as module-level Python. The injected code executes at `import` time of the generated `.py`, in the context of any consumer that imports the model. No special CLI flags are required.\n\nThis affects versions `\u003e=0.25.0, \u003c0.60.1` and is fixed in `0.60.1`.\n\n### Details\n\nThe vulnerable output was generated by the GraphQL Union templates:\n\n- `src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2`\n- `src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2`\n- `src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2`\n\nBefore `0.60.1`, Union descriptions were rendered as Python comments using logic equivalent to `# {{ description | replace(\u0027\\n\u0027, \u0027\\n# \u0027) }}`.\n\nThe Jinja2 `replace` filter handled `\\n`, but bare `\\r` was not normalized. Python\u0027s lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.\n\nThe `description` value reaches Union generation from `graphql-core` through `description=union_object.description`. GraphQL regular string values can contain `\\r` escapes, and `graphql-core` preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.\n\n### Impact\n\nAn attacker who can provide or influence a GraphQL schema processed by `datamodel-code-generator` could cause arbitrary Python code to be generated into the output file. That code would execute with the privileges of the process importing the generated model.\n\nThis can affect developers, CI pipelines, or applications that run `datamodel-codegen --input-file-type graphql` on untrusted or third-party GraphQL schemas and then import the generated Python module.\n\nNo custom templates, special CLI flags, or remote reference options are required.\n\n### Remediation\n\nUpgrade to `datamodel-code-generator` `0.60.1` or later.\n\nThe fix normalizes carriage returns in GraphQL Union descriptions before rendering them as Python comments, so injected text remains inside the comment block.\n\n### Resolution\n\nThe fix applies `comment_safe` to GraphQL Union descriptions before template rendering. It normalizes CRLF and bare CR to LF so the existing Union comment templates keep the whole description inside the generated Python comment block.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
"id": "GHSA-j884-q54q-mmx3",
"modified": "2026-07-28T21:35:49Z",
"published": "2026-07-28T21:35:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3"
},
{
"type": "PACKAGE",
"url": "https://github.com/koxudaxi/datamodel-code-generator"
},
{
"type": "WEB",
"url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.