CVE-2026-54621

This CVE involves carriage return (0x0D) injection in datamodel-code-generator versions before 0.60.1. When GraphQL schema descriptions containing embedded \r characters are rendered into Python code via the UnionTypeStatement.jinja2 or UnionTypeStatement.py312.jinja2 templates, the CR can cause the Python comment boundary to desynchronize—the # comment terminator respects newline (0x0A), not carriage return. This means a schema description field containing \r\n can cause subsequent source lines to execute as code rather than remain within the comment block. The severity is systematically underestimated by CVSS and EPSS (0.00142) because these metrics fail to capture the compound risk of schema ingestion pipelines. Code generation tools in CI/CD workflows often process external GraphQL sources—federated subgraphs, API registries, third-party schema definitions—without the same scrutiny applied to application code. The trust boundary question is whether your organization treats these external schemas as untrusted input requiring sanitization before passing to code generators. Beyond patching to 0.60.1, audit your Jinja2 template inventory: the surgical nature of the patch (two specific templates) suggests the underlying pattern—rendering arbitrary schema string content into Python comments without sanitization—may exist elsewhere in the codebase or its forks. Additionally, if your organization commits generated model files to version control, examine git history for any models generated during the vulnerable window. The injected payload persists in repository history even after patching; remediation requires explicit history rewriting if commits predate the fix. For organizations pinning to older Python target versions, verify whether equivalent patches exist for template variants targeting Python 3.10, 3.9, or earlier—deprecation doesn't guarantee exclusion from the rendering pipeline.

Reviewed through automated stages and approved by a human before publication.