DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54654: CVE-2026-54654: Python Code Injection in datamodel-code-generator via Comment Line-Break Escape

#security #cve #cybersecurity

CVE-2026-54654: Python Code Injection in datamodel-code-generator via Comment Line-Break Escape

Vulnerability ID: CVE-2026-54654
CVSS Score: 7.8
Published: 2026-07-28

A vulnerability in the datamodel-code-generator library allows for unauthenticated remote code execution when generating code from malicious or untrusted schema specifications. By embedding special physical line terminators, such as carriage returns, vertical tabs, or form feeds, within template values, an attacker can break out of inline Python comment boundaries. The generated output file subsequently contains un-commented python instructions that execute automatically during module import.

TL;DR

A local code injection vulnerability exists in datamodel-code-generator versions prior to 0.60.2. Inadequate sanitization of line terminators in the comment metadata of schema templates allows attackers to inject arbitrary executable statements into generated Python code, which triggers code execution when the generated files are imported.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94, CWE-1336
  • Attack Vector: Local (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • CVSS Severity Score: 7.8 (High)
  • Exploit Status: Proof-of-Concept (PoC) available
  • Primary Vulnerable Component: Jinja2 template interpolation logic in koxudaxi/datamodel-code-generator
  • Fix Version: 0.60.2

Affected Systems

  • datamodel-code-generator versions starting from 0.14.1 up to (but not including) 0.60.2
  • datamodel-code-generator: >= 0.14.1, < 0.60.2 (Fixed in: 0.60.2)

Code Analysis

Commit: b73abb5

Fix: Escape carriage returns and vertical whitespace inside inline comment values to avoid code injection breakouts

Mitigation Strategies

  • Upgrade datamodel-code-generator to version 0.60.2 or higher to ensure inputs are properly sanitized.
  • Implement pre-processing scripts that scrub or reject carriage returns, vertical tabs, and form feeds from JSON metadata input before compiling files.
  • Avoid importing unverified generated models directly in production deployments without initial syntactic sanity checks or static scanning.

Remediation Steps:

  1. Inspect requirements.txt, poetry.lock, or Pipfile configurations to detect vulnerable versions of the generator (< 0.60.2).
  2. Execute the package manager update command: pip install --upgrade "datamodel-code-generator>=0.60.2".
  3. Review any internal workflows that utilize absolute paths for custom templates, as these bypass default comment sanitization features and must be audited manually.

References

Read the full report for CVE-2026-54654 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)