CVE-2026-54654

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1

Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return (r). The software renders this comment variable into Python comments within several templates without neutralizing line terminators. Because the Python tokenizer treats a carriage return as a physical-line terminator, the comment is prematurely ended, allowing subsequent text to be parsed and executed as Python code when the generated models are imported. This can lead to arbitrary code execution in the process of the importer.

Recommendations Upgrade datamodel-code-generator to version 0.60.2 or later. As a temporary mitigation, avoid using the --extra-template-data flag or ensure that the comment values in the extras file do not contain carriage returns (r), vertical tabs (x0b), or form feeds (x0c).