GHSA-j884-q54q-mmx3

Summary

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("...") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is parsed as module-level Python. The injected code executes at import time of the generated .py, in the context of any consumer that imports the model. No special CLI flags are required.

This affects versions >=0.25.0, <0.60.1 and is fixed in 0.60.1.

Details

The vulnerable output was generated by the GraphQL Union templates:

• src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2
• src/datamodel_code_generator/model/template/UnionTypeAliasAnnotation.jinja2
• src/datamodel_code_generator/model/template/UnionTypeAliasType.jinja2

Before 0.60.1, Union descriptions were rendered as Python comments using logic equivalent to # {{ description | replace('\n', '\n# ') }}.

The Jinja2 replace filter handled \n, but bare \r was not normalized. Python's lexical analysis treats CR, LF, and CRLF as physical line terminators. As a result, a malicious GraphQL schema could cause the generated Python comment to end early and emit attacker-controlled text as module-level Python code.

The description value reaches Union generation from graphql-core through description=union_object.description. GraphQL regular string values can contain \r escapes, and graphql-core preserves that value. Block strings are not affected in the same way because their line endings are normalized before reaching code generation.

Impact

An attacker who can provide or influence a GraphQL schema processed by datamodel-code-generator could cause arbitrary Python code to be generated into the output...