Summary
datamodel-code-generator vulnerable to code injection via unescaped carriage return in GraphQL Union description
datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("...") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is parsed as module-level Python. The injected code executes at import time of the generated .py, in the context of any consumer that imports the model. No special CLI flags are required.
This affects versions >=0.25.0, <0.60.1 and is fixed in 0.60.1.
Details
The vulnerable output was generated by the GraphQL Union templates:
src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2
Before 0.60.1, Union descriptions were rendered as Python comments using logic equivalent to # {{ description | replace('\n', '\n# ') }}.
The Jinja2 replace filter handled \n, but bare \r was not normalized. Python's lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.
The description value reaches Union generation from graphql-core through description=union_object.description. GraphQL regular string values can contain \r escapes, and graphql-core preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.
Resolution
The fix applies comment_safe to GraphQL Union descriptions before template rendering. It normalizes CRLF and bare CR to LF so the existing Union comment templates keep the whole description inside the generated Python comment block.
Submitted by: Hamza Haroon (thegr1ffyn)
Impact
An attacker who can provide or influence a GraphQL schema processed by datamodel-code-generator could cause arbitrary Python code to be generated into the output file. That code would execute with the privileges of the process importing the generated model.
This can affect developers, CI pipelines, or applications that run datamodel-codegen --input-file-type graphql on untrusted or third-party GraphQL schemas and then import the generated Python module.
No custom templates, special CLI flags, or remote reference options are required.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-54621 has a CVSS score of 7.8 (High). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.60.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to datamodel-code-generator 0.60.1 or later.
The fix normalizes carriage returns in GraphQL Union descriptions before rendering them as Python comments, so injected text remains inside the comment block.
Frequently Asked Questions
- What is CVE-2026-54621? CVE-2026-54621 is a high-severity code injection vulnerability in datamodel-code-generator (pip), affecting versions >= 0.25.0, < 0.60.1. It is fixed in 0.60.1. Untrusted input is evaluated as executable code within the application's runtime environment.
- How severe is CVE-2026-54621? CVE-2026-54621 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of datamodel-code-generator are affected by CVE-2026-54621? datamodel-code-generator (pip) versions >= 0.25.0, < 0.60.1 is affected.
- Is there a fix for CVE-2026-54621? Yes. CVE-2026-54621 is fixed in 0.60.1. Upgrade to this version or later.
- Is CVE-2026-54621 exploitable, and should I be worried? Whether CVE-2026-54621 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54621 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54621? Upgrade
datamodel-code-generatorto 0.60.1 or later.