PT-2026-65612 · Pypi · Datamodel-Code-Generator
CVE-2026-54690
·
Published
2026-07-28
·
Updated
2026-07-28
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
datamodel-code-generator versions 0.9.1 through 0.60.1
Description
An issue exists where the software silently dereferences HTTP or HTTPS URLs provided in JSON Schema
$ref values without performing IP or host validation, scheme allow-listing, or redirect validation. This occurs within the get ref body() function in src/datamodel code generator/parser/jsonschema.py and utilizes the fetcher in src/datamodel code generator/http.py.When the
--allow-remote-refs gate is set to its default value of None, the system only emits a deprecation warning and proceeds to fetch the URL. The retrieved content is then parsed as a sub-schema and reflected verbatim into the generated Python source code. This allows a malicious actor to provide a crafted JSON Schema or OpenAPI document that triggers server-side request forgery (SSRF), potentially pivoting to arbitrary internal addresses and leaking sensitive internal responses into the generated code. This issue specifically affects users who have installed the [http] extra.Recommendations
Update datamodel-code-generator to version 0.61.0.
As a temporary mitigation, explicitly set the
--allow-remote-refs=false flag to block remote requests.Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datamodel-Code-Generator