The datamodel-code-generator tool generates Python data models from schema definitions. In versions before 0.60.1, the rendering of GraphQL Union description values into Python comments in specific template files does not neutralize carriage returns. This flaw enables an attacker to craft GraphQL schema content that injects Python code into the generated models. When these models are imported, the injected code executes, leading to potential full compromise of confidentiality, integrity, and availability. The vulnerability is tracked as CWE-94 (Improper Control of Generation of Code) and CWE-1336, with a CVSS v3.1 score of 7.8 (high severity).

Successful exploitation allows an attacker with the ability to supply GraphQL schema content to inject and execute arbitrary Python code within the generated data models. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access to the code generation process (AV:L) and user interaction (UI:R) but does not require privileges (PR:N).

This vulnerability is fixed in datamodel-code-generator version 0.60.1. Users should upgrade to version 0.60.1 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, avoid importing generated models from untrusted GraphQL schemas.