PT-2026-65613 · Pypi · Datamodel-Code-Generator

CVE-2026-54691 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1

Description The get body() function in src/datamodel code generator/http.py fails to validate host or IP addresses when processing targets provided via the --url argument or through redirect chains. This allows server-side request forgery (SSRF), where an attacker can force the application to make requests to loopback, private, link-local (such as cloud metadata services at 169.254.169.254), or other internal network resources. Because the tool follows redirects unconditionally and only filters out text/html content, non-HTML responses from internal APIs or services are parsed as schemas and embedded into the generated Python source files, potentially exfiltrating sensitive internal data to anyone with access to the output files.

Recommendations Update datamodel-code-generator to version 0.61.0. As a temporary mitigation, avoid using the --url argument with untrusted URLs or restrict the environment's network access to prevent requests to internal resources.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54691

GHSA-RFR2-MQ9M-X2QX

Affected Products

Datamodel-Code-Generator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54691 · Security Note
• https://osv.dev/vulnerability/GHSA-rfr2-mq9m-x2qx · Vendor Advisory
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0 · Note
• https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note