Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the handling of GraphQL Union descriptions within the datamodel-code-generator. An unescaped carriage return (\r) in a Union's description could lead to code injection in the generated Python model. The analysis of the provided security patch (commit aec47bc414779f4a9992b3919c8f7663afd6c988) reveals that the fix was implemented in the datamodel_code_generator.model.union.Union class. Specifically, the __init__ method of this class now sanitizes the description field using a new comment_safe function. This function, added in src/datamodel_code_generator/model/base.py, normalizes line endings by replacing \r\n and \r with \n. The vulnerable function is therefore datamodel_code_generator.model.union.Union.__init__, as it was the entry point for the malicious description into the code generation process without proper sanitization. The patch directly modifies this function to apply the fix, confirming it as the location of the vulnerability.
datamodel_code_generator.model.union.Union.__init__src/datamodel_code_generator/model/union.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| datamodel-code-generator | pip | >= 0.25.0, < 0.60.1 | 0.60.1 |