PT-2026-65616 · Pypi · Datamodel-Code-Generator

CVE-2026-55403 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0

Description When fetching remote schemas, the software re-sends original request headers to redirect targets even if the redirect changes the origin (host, port, or scheme). This occurs within the get body() function in src/datamodel code generator/http.py, which manually follows redirects without verifying if the origin remains the same. Consequently, sensitive headers such as Authorization, Cookie, and Proxy-Authorization can be leaked to an unauthorized or attacker-controlled host if the trusted schema host issues a cross-origin redirect. These leaked credentials could potentially be replayed against the trusted host.

Recommendations Update datamodel-code-generator to version 0.63.0.

Fix

Open Redirect

Information Disclosure

Weakness Enumeration

CWE-601

CWE-200

Related Identifiers

CVE-2026-55403

GHSA-R5VV-FF45-PRP2

Affected Products

Datamodel-Code-Generator

References · 6

• https://osv.dev/vulnerability/GHSA-r5vv-ff45-prp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55403 · Security Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 · Note
• https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note