Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-23 | 1 | General1 |
| 2026-07-29 | 2 | Disclosure1General1 |
CVE-2026-54654 datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Pyth… https://www.cve.org/CVERecord?id=CVE-2026-54654
Post summary
The text announces CVE-2026-54654 for datamodel‑code‑generator, describing a potential code injection issue without providing PoC, exploit, or patch details.
CVE-2026-54621 CVE-2026-54653 CVE-2026-54654 CVE-2026-54655 CVE-2026-54656 CVE-2026-54690 CVE-2026-54691 CVE-2026-55415 CVE-2026-55389 CVE-2026-55390 CVE-2026-55391 CVE-2026-55403
Post summary
The statement consists solely of a list of CVE identifiers without any accompanying technical details, exploitation information, or remediation guidance.
🚨*CVE* CVE-2026-54654 datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Pyth… https://www.cve.org/CVERecord?id=CVE-2026-54654 ----- Traducción: CVE-2026-54654 dat… http://infoflow.cloud`
Post summary
The tweet simply notes the existence of CVE-2026-54654 for datamodel-code-generator, mentioning a rendering flaw in a specific configuration option, without providing additional technical data, exploits, or mitigation information.