CyberRota Analysis
AI-GeneratedThe vulnerability affects the datamodel-code-generator, which creates Python data models from schema definitions, specifically prior to version 0.60.1. An attacker can exploit this flaw by injecting malicious GraphQL schema content that gets rendered as executable Python code in generated models, leading to potential code execution upon import. Organizations using affected versions of this tool should prioritize updating to version 0.60.1 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.