{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/datamodel-code-generator-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["datamodel-code-generator (0.14.1 to 0.60.1)"],"_cs_severities":["high"],"_cs_tags":["code-injection","supply-chain","rce","python","vulnerability"],"_cs_type":"advisory","_cs_vendors":["datamodel-code-generator project"],"content_html":"\u003cp\u003eThe \u003ccode\u003edatamodel-code-generator\u003c/code\u003e Python package, specifically versions between \u003ccode\u003e0.14.1\u003c/code\u003e and \u003ccode\u003e0.60.1\u003c/code\u003e inclusive, contains a critical code injection vulnerability, CVE-2026-54654. This flaw allows arbitrary Python code execution during the import of generated code when a developer utilizes the \u003ccode\u003e--extra-template-data\u003c/code\u003e command-line option with an input file containing a maliciously crafted \u003ccode\u003ecomment\u003c/code\u003e field. If this \u003ccode\u003ecomment\u003c/code\u003e field includes an unescaped carriage return (\u003ccode\u003e\\r\u003c/code\u003e), Python's tokenizer treats it as a line terminator, allowing subsequent text to be parsed as executable Python code instead of remaining within a comment block. This poses a significant risk to developers and CI/CD pipelines that process untrusted or attacker-controlled input in their \u003ccode\u003e--extra-template-data\u003c/code\u003e files, potentially leading to supply chain compromises and remote code execution in development environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious \u003ccode\u003e--extra-template-data\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe malicious file's \u003ccode\u003ecomment\u003c/code\u003e field contains a literal carriage return (\u003ccode\u003e\\r\u003c/code\u003e) followed by arbitrary Python code.\u003c/li\u003e\n\u003cli\u003eA developer or CI/CD pipeline invokes \u003ccode\u003edatamodel-code-generator\u003c/code\u003e (versions \u003ccode\u003e0.14.1\u003c/code\u003e to \u003ccode\u003e0.60.1\u003c/code\u003e) with the \u003ccode\u003e--extra-template-data\u003c/code\u003e option pointing to the malicious file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edatamodel-code-generator\u003c/code\u003e uses Jinja2 templates, which interpolate the \u003ccode\u003ecomment\u003c/code\u003e value directly without escaping line terminators.\u003c/li\u003e\n\u003cli\u003eThe generated Python code file will contain the unescaped carriage return within what should be a comment line.\u003c/li\u003e\n\u003cli\u003eWhen this generated Python file is subsequently imported by a Python interpreter, the bare \u003ccode\u003e\\r\u003c/code\u003e acts as a physical line terminator.\u003c/li\u003e\n\u003cli\u003eThe Python interpreter ceases treating the line as a comment after the \u003ccode\u003e\\r\u003c/code\u003e and parses the attacker-controlled Python code that follows.\u003c/li\u003e\n\u003cli\u003eThis results in arbitrary Python code execution within the context of the importing process, achieving code injection.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability (CVE-2026-54654) affects any developer or CI pipeline that uses \u003ccode\u003edatamodel-code-generator\u003c/code\u003e versions between \u003ccode\u003e0.14.1\u003c/code\u003e and \u003ccode\u003e0.60.1\u003c/code\u003e and processes \u003ccode\u003e--extra-template-data\u003c/code\u003e files influenced by attacker-controlled input. Successful exploitation grants attackers arbitrary Python code execution within the developer's or build system's environment during the import phase of the generated code. This can lead to severe consequences, including intellectual property theft, unauthorized access to source code repositories, injection of malicious dependencies, and compromise of build artifacts, potentially affecting an organization's entire software supply chain. The vulnerability does not require the schema itself to be malicious, only the \u003ccode\u003ecomment\u003c/code\u003e field in the extra template data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003edatamodel-code-generator\u003c/code\u003e to version \u003ccode\u003e0.60.2\u003c/code\u003e or later immediately to remediate CVE-2026-54654.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for all \u003ccode\u003e--extra-template-data\u003c/code\u003e files, particularly the \u003ccode\u003ecomment\u003c/code\u003e field, to prevent the inclusion of unescaped carriage returns (\u003ccode\u003e\\r\u003c/code\u003e), vertical tabs (\u003ccode\u003e\\x0b\u003c/code\u003e), or form feeds (\u003ccode\u003e\\x0c\u003c/code\u003e) before invoking \u003ccode\u003edatamodel-code-generator\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview CI/CD pipelines and developer workflows that use \u003ccode\u003edatamodel-code-generator\u003c/code\u003e and process external or untrusted data sources to ensure such inputs are properly sanitized.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T21:52:07Z","date_published":"2026-07-28T21:52:07Z","id":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-code-injection/","summary":"The `datamodel-code-generator` Python package is vulnerable to code injection (CVE-2026-54654) when a developer uses the `--extra-template-data` option with a file whose `comment` value contains an unescaped carriage return, leading to arbitrary Python code execution during the import process of the generated code.","title":"datamodel-code-generator Vulnerable to Code Injection via Unescaped Carriage Return","url":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Datamodel-Code-Generator Project","version":"https://jsonfeed.org/version/1.1"}