The defect allows an attacker to supply a comment string via the --extra-template-data option that is written directly into Python comment lines in several Jinja2 templates without neutralising carriage returns. Because the injected text can terminate the comment and begin an executable statement, the generated Python module becomes a vector for arbitrary code execution when it is later imported. This leads to loss of confidentiality, integrity and availability at the process level, matching CWE-1336 (Unsanitised Input) and CWE-94 (Code Injection).

The vulnerability is present in the datamodel-code-generator package from vendor koxudaxi. Any installation of versions 0.14.1 through 0.60.1 is affected; the problem is fixed in release 0.60.2 and later, while earlier pre‑0.14.1 builds are not impacted according to the available data.

The CVSS score of 7.8 indicates high potential impact. The EPSS score of less than 1 % denotes a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to control the comment input when running datamodel-code-generator and then cause the produced module to be imported in a trusted environment, such as a continuous‑integration job that automatically loads generated models. Successful exploitation would give the attacker full code execution on the host running the import.