CVE-2026-54621: Koxudaxi Datamodel-Code-Generator

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.

Affected products

• Koxudaxi Datamodel-Code-Generator: from 0.25.0, before 0.60.1 (fixed in 0.60.1)

Published 2026-07-28. Last modified 2026-07-30.