Skip to content
Heist/ feed
Back to feed
High

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

Type: advisorySources: OSV

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-54654
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 18:46 UTC · Revision 1

Source evidence

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

core-osv · Original source

Published 28 Jul 2026, 21:22 UTC

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.

osv:CVE-2026-54654
Complete source record
{
  "id": "01b72f7ba86a69864dcbad09901b0f4132da90f47368140c940c04af7e629aac",
  "url": "https://osv.dev/vulnerability/CVE-2026-54654",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field",
    "summary": "datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.",
    "evidence": "osv:CVE-2026-54654",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-54654",
      "aliases": [
        "CVE-2026-54654",
        "GHSA-wjv6-jcfj-mf9r",
        "PYSEC-2026-3566"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/datamodel-code-generator/datamodel-code-generator",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c4e8f2c8680b5cdbfb8d718f98c3ca6978f4e6e5"
                },
                {
                  "fixed": "e0ea4e45117acd41dcf6ae3a6639cc3f41b59045"
                },
                {
                  "fixed": "b73abb5cd703a50471b8950bbd3bd0b82ad71de7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.14.1"
                      },
                      {
                        "fixed": "0.60.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b73abb5cd703a50471b8950bbd3bd0b82ad71de7"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "e0ea4e45117acd41dcf6ae3a6639cc3f41b59045"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "0.60.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.60.1",
            "0.60.0",
            "0.59.1",
            "0.59.0",
            "0.58.0",
            "0.57.0",
            "0.56.1",
            "0.56.0",
            "0.55.0",
            "0.54.1",
            "0.54.0",
            "0.53.0",
            "0.52.2",
            "0.52.1",
            "0.52.0",
            "0.51.0",
            "0.50.0",
            "0.49.0",
            "0.48.0",
            "0.47.0",
            "0.46.0",
            "0.45.0",
            "0.44.0",
            "0.43.1",
            "0.43.0",
            "0.42.2",
            "0.42.1",
            "0.42.0",
            "0.41.0",
            "0.40.0",
            "0.39.0",
            "0.38.0",
            "0.37.0",
            "0.36.0",
            "0.35.0",
            "0.34.0",
            "0.33.0",
            "0.32.0",
            "0.31.2",
            "0.31.1",
            "0.31.0",
            "0.30.2",
            "0.30.1",
            "0.30.0",
            "0.29.0",
            "0.28.5",
            "0.28.4",
            "0.28.3",
            "0.28.2",
            "0.28.1",
            "0.28.0",
            "0.27.3",
            "0.27.2",
            "0.27.1",
            "0.27.0",
            "0.26.5",
            "0.26.4",
            "0.26.3",
            "0.26.2",
            "0.26.1",
            "0.26.0",
            "0.25.9",
            "0.25.8",
            "0.25.7",
            "0.25.6",
            "0.25.5",
            "0.25.4",
            "0.25.3",
            "0.25.2",
            "0.25.1",
            "0.25.0",
            "0.24.2",
            "0.24.1",
            "0.24.0",
            "0.23.0",
            "0.22.1",
            "0.22.0",
            "0.21.5",
            "0.21.4",
            "0.21.3",
            "0.21.2",
            "0.21.1",
            "0.21.0",
            "0.20.0",
            "0.19.0",
            "0.18.1",
            "0.18.0",
            "0.17.2",
            "0.17.1",
            "0.17.0",
            "0.16.1",
            "0.16.0",
            "0.15.0",
            "0.14.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54654.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.238375623Z",
      "provider": "osv",
      "references": [
        "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54654.json",
        "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54654",
        "https://github.com/koxudaxi/datamodel-code-generator/commit/b73abb5cd703a50471b8950bbd3bd0b82ad71de7"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1336",
          "CWE-94"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54654.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-54654",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 488724,
  "published_at": "2026-07-28T21:22:52.07+00:00"
}