Summary
datamodel-code-generator vulnerable to code injection via unescaped carriage return in --extra-template-data comment field
datamodel-code-generator is vulnerable to code injection when a developer passes an --extra-template-data file whose comment value contains a literal \r (carriage return). The comment variable is rendered into a Python # comment in six built-in templates with no line-terminator escaping. Python's tokenizer treats a bare CR as a physical-line terminator (see Python language reference, Physical lines), so the comment ends at the \r and the text after it is parsed as Python, including, when the CR is followed by suitable indentation, as a statement within the class body that follows on the next template line.
Details
The vulnerable templates each contain # {{ comment }} with no escaping:
src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2:12and:19src/datamodel_code_generator/model/template/TypeAliasType.jinja2:12and:19src/datamodel_code_generator/model/template/TypeStatement.jinja2:12and:19src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2:4src/datamodel_code_generator/model/template/pydantic_v2/RootModel.jinja2:19src/datamodel_code_generator/model/template/pydantic_v2/RootModelTypeAlias.jinja2:13
The pydantic_v2/BaseModel.jinja2:4 site is representative:
class {{ class_name }}({{ base_class }}):{% if comment is defined %} # {{ comment }}{% endif %}
When the developer-supplied extras file populates comment for a model, the value reaches the template via DataModel.extra_template_data (set in src/datamodel_code_generator/model/base.py:736-742) and Jinja2 interpolates it raw. None of the templates use comment_safe, escape_docstring, or any other line-terminator filter.
PoC
Complete self contained POC is available at my secret gist: https://gist.github.com/thegr1ffyn/8ad6b8cb3cc2be9d3a0144aeb6896a3f
Resolution
The fix normalizes comment values from built-in --extra-template-data before template rendering. Inline comments now convert CRLF, bare CR, vertical tab, and form feed into LF and prefix continuation lines with # , so attacker-controlled text stays inside the generated Python comment block.
Submitted by: Hamza Haroon (thegr1ffyn)
Impact
- Who's affected: any developer or CI pipeline that runs
datamodel-codegen --extra-template-data <file>where the extras file is influenced by attacker-controlled input. Realistic scenarios include:- Extras file generated from a third-party schema-annotation system.
- Extras file vendored from an upstream repository.
- Extras file produced by a script that merges multiple
commentsources. - Build pipelines that template the extras file from environment variables, ticket descriptions, or commit metadata.
- What it gains: arbitrary Python code execution in the importer's process at
importtime. - What it does NOT need: the schema itself can be entirely benign; only the extras file needs to contain the malicious
comment. - What does block it: not passing
--extra-template-data, or rejecting extras files whosecommentvalues contain\r,\x0b, or\x0cbefore invocation.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-54654 has a CVSS score of 7.8 (High). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.60.2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to datamodel-code-generator 0.60.2 or later.
This issue affects datamodel-code-generator versions >= 0.14.1, <= 0.60.1 and is fixed in 0.60.2.
Frequently Asked Questions
- What is CVE-2026-54654? CVE-2026-54654 is a high-severity code injection vulnerability in datamodel-code-generator (pip), affecting versions >= 0.14.1, <= 0.60.1. It is fixed in 0.60.2. Untrusted input is evaluated as executable code within the application's runtime environment.
- How severe is CVE-2026-54654? CVE-2026-54654 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of datamodel-code-generator are affected by CVE-2026-54654? datamodel-code-generator (pip) versions >= 0.14.1, <= 0.60.1 is affected.
- Is there a fix for CVE-2026-54654? Yes. CVE-2026-54654 is fixed in 0.60.2. Upgrade to this version or later.
- Is CVE-2026-54654 exploitable, and should I be worried? Whether CVE-2026-54654 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54654 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54654? Upgrade
datamodel-code-generatorto 0.60.2 or later.