The datamodel-code-generator tool generates Python data models from schema definitions. Between versions 0.14.1 and 0.60.2, the --extra-template-data comment field is incorporated into Python comments in multiple Jinja2 template files without sanitizing carriage returns. This improper handling allows an attacker to inject Python code into the generated models, which executes upon import. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and CWE-1336, and it has a CVSS 3.1 score of 7.8, indicating high severity. The issue is resolved in version 0.60.2.

An attacker able to control the --extra-template-data comment field can inject arbitrary Python code into the generated data model files. This code executes when the generated models are imported, potentially leading to full compromise of the environment running the code. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade datamodel-code-generator to version 0.60.2 or later, where this code injection vulnerability is fixed. No other mitigations are documented. Patch status is confirmed fixed in 0.60.2.