https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T09:27:29.208151+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54621 CVE-2026-54621 — `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description 2026-10-10T09:27:29.225412+00:00

Affected: koxudaxi datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.