CVE-2026-54621

{
  "id": "CVE-2026-54621",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T22:17:39.930",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1."
    },
    {
      "lang": "es",
      "value": "datamodel-code-generator genera modelos de datos Python a partir de definiciones de esquema. Antes de la versión 0.60.1, los valores de descripción de uniones GraphQL en src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 y src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 se renderizan en comentarios de Python sin neutralizar los retornos de carro en los comentarios de Python #, lo que permite que el contenido de esquema GraphQL controlado por el atacante inyecte código Python en los modelos generados que se ejecuta al ser importado. Este problema está solucionado en la versión 0.60.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "koxudaxi",
          "product": "datamodel-code-generator",
          "versions": [
            {
              "version": ">= 0.25.0, < 0.60.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T12:34:28.223250Z",
          "id": "CVE-2026-54621",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3",
      "source": "[email protected]"
    }
  ]
}