CVE-2026-54621: datamodel-code-generator RCE Vulnerability

CVE-2026-54621 Overview

CVE-2026-54621 is a code injection vulnerability [CWE-94] in datamodel-code-generator, a Python library that generates data models from schema definitions. Versions prior to 0.60.1 fail to neutralize carriage return characters when rendering GraphQL Union description values into Python comments. An attacker who controls the input GraphQL schema can inject arbitrary Python code into generated model files. The injected code executes when a developer imports the generated module.

Critical Impact
Attacker-controlled GraphQL schema content can inject Python code into generated data models, achieving arbitrary code execution when the generated code is imported by developers or CI pipelines.

Affected Products

datamodel-code-generator versions prior to 0.60.1
Templates: src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2
Templates: src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2

Discovery Timeline

2026-07-28 - CVE-2026-54621 published to NVD
2026-07-29 - Last updated in NVD database
Patch released in datamodel-code-generator version 0.60.1 — see GitHub Release v0.60.1

Technical Details for CVE-2026-54621

Vulnerability Analysis

The flaw resides in the Jinja2 templates that render GraphQL Union type descriptions as Python comments. The templates prefix line-feed (LF) continuation lines with # but do not process carriage return (CR) or CRLF sequences. Python treats a bare carriage return as a line terminator. An attacker embedding \r inside a GraphQL Union description can therefore break out of the comment block, terminating the # comment and injecting executable Python statements into the generated model file.

Exploitation requires a developer or automated build system to run datamodel-code-generator against an attacker-controlled schema and then import the resulting Python module. Local user interaction is required, which aligns with the assigned attack vector.

Root Cause

The root cause is missing input neutralization of special characters (\r and \r\n) before rendering user-supplied schema description text into Python source code. The template assumed all newline sequences were LF, so CR-delimited content escaped the comment context and became live code in the generated file.

Attack Vector

An attacker distributes or hosts a malicious GraphQL schema containing a Union type whose description field embeds carriage returns followed by Python statements. When a victim runs datamodel-code-generator to generate models from the schema, the payload is written verbatim into the output .py file. Import of that module triggers the injected code with the privileges of the importing process.

python

# Security patch — src/datamodel_code_generator/model/base.py
# Normalizes CR/CRLF to LF before descriptions are rendered as Python comments

def comment_safe(value: str | None) -> str | None:
    """Normalize line endings before rendering text in Python comments.

    Built-in union templates already prefix LF continuation lines with ``# ``.
    This helper converts CRLF and bare CR into LF so that existing template
    behavior keeps the whole description inside the comment block.
    """
    if value is None:
        return None
    # Collapse CRLF before converting lone CR.
    return value.replace("\r\n", "\n").replace("\r", "\n")

Source: GitHub Commit aec47bc

Detection Methods for CVE-2026-54621

Indicators of Compromise

Generated Python files containing unexpected top-level statements, imports, or function calls following a # comment line derived from a GraphQL description.
Presence of raw \r bytes (0x0D) inside .py files produced by datamodel-code-generator.
Outbound network connections or subprocess spawns originating from Python processes that import freshly generated model modules.

Detection Strategies

Scan repositories and build artifacts for .py files output by datamodel-code-generator and inspect them for bare CR characters or code lines that were not authored by developers.
Diff generated model outputs against schema descriptions to identify content that escaped comment boundaries.
Audit CI/CD logs for datamodel-codegen invocations that consume schemas from untrusted sources.

Monitoring Recommendations

Monitor Python interpreter processes on developer workstations and build agents for unexpected child processes or network egress after model import.
Alert on installations of datamodel-code-generator versions below 0.60.1 in software bill of materials (SBOM) inventories.
Track modifications to files under paths consuming GraphQL schemas in build pipelines.

How to Mitigate CVE-2026-54621

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.60.1 or later across all developer workstations and CI/CD systems.
Regenerate any Python models previously produced from third-party or externally sourced GraphQL schemas using the patched version.
Review existing generated modules for injected code before re-importing them in production environments.

Patch Information

The fix is available in datamodel-code-generator0.60.1. The patch introduces a comment_safe() helper in src/datamodel_code_generator/model/base.py that collapses \r\n and bare \r sequences to \n before description values are rendered into Python comments. See the GitHub Security Advisory GHSA-j884-q54q-mmx3 for full details.

Workarounds

Restrict datamodel-code-generator execution to trusted, internally authored GraphQL schemas until the upgrade is complete.
Pre-process schema inputs to strip or normalize \r and \r\n sequences from Union description fields before code generation.
Run code generation inside an isolated sandbox and manually review generated .py files before importing them.

bash

# Upgrade to the patched release
pip install --upgrade 'datamodel-code-generator>=0.60.1'

# Verify installed version
python -c "import datamodel_code_generator; print(datamodel_code_generator.__version__)"

# Optional: audit generated outputs for stray carriage returns
grep -rlP '\r' path/to/generated/models/