CVE-2026-54654

Received Received - Intake

Template Injection in datamodel-code-generator via Comment Field

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54654

Affected Vendors & Products

Vendor	Product	Version / Range
datamodel-code-generator	datamodel-code-generator	From 0.14.1 (inc) to 0.60.2 (inc)
datamodel-code-generator	datamodel-code-generator	0.60.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

The vulnerability in datamodel-code-generator allows attackers to inject Python code into generated models through the --extra-template-data comment field. This happens because carriage returns in comments are not neutralized, enabling code execution when the generated models are imported.

Detection Guidance

This vulnerability can be detected by checking the version of datamodel-code-generator installed on your system. If the version is between 0.14.1 and 0.60.2, it is vulnerable. Run: pip show datamodel-code-generator to check the version.

Impact Analysis

If you use affected versions of datamodel-code-generator, an attacker could craft malicious input that injects and executes arbitrary Python code when you import generated models. This could lead to data breaches, system compromise, or unauthorized actions.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data exposure or manipulation. Organizations may face penalties for failing to protect sensitive data under GDPR or HIPAA.

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.60.2 or later. Run: pip install --upgrade datamodel-code-generator. Additionally, review any generated Python models for unexpected code injection in comments.

Hi! I’m here to help you understand CVE-2026-54654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70