datamodel-code-generator CVE-2026-54690

Requires the optional HTTP extra to be installed (pip install 'datamodel-code-generator[http]'); without it there is no network fetcher and the flaw is not reachable. The tool must be run on a JSON Schema / OpenAPI / other supported document that the attacker controls or influenced (a $ref containing an attacker-chosen HTTP/HTTPS URL). Exploitation fires under the default configuration where --allow-remote-refs is unset (None), which only warns and then fetches; it is blocked only by explicitly passing --allow-remote-refs=false. Note --url implies remote-ref fetching. The primary limiting factor is required user interaction (UI:R): a developer or automated codegen/CI step must actually invoke datamodel-codegen against the malicious document - there is no standalone network-listening service to attack.

Signals are consistent and point to a real-but-moderate priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, base 8.2 High) reflects a network-reachable, low-complexity, unauthenticated SSRF whose severity is inflated by S:C and C:H. EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing, so no active exploitation is indicated - SSVC confirms this with exploitation:poc, automatable:no, technical-impact:partial. Public exploit code exists (two gists plus a vuldb advisory), so weaponization is trivial once a target is reachable, but the automatable:no and UI:R factors mean this cannot be sprayed at scale - it requires a developer to run the tool on an attacker-influenced schema. The vendor's C:H is arguably overstated: SSVC rates technical impact only 'partial' and the leak is limited to schema-shaped fields (title/description/properties) reflected into generated code, so C:L is more defensible. A key limiting factor not captured in the base score is that the flaw only affects installations that added the optional [http] extra. Net: prioritize patching in CI/codegen pipelines that fetch third-party schemas, but this is not a mass-exploitation internet threat.

A developer or CI pipeline runs datamodel-codegen (installed with the [http] extra) against a JSON Schema or OpenAPI document of uncertain provenance that contains a $ref pointing at an internal URL such as http://169.254.169.254/ or an intranet admin service. With the default --allow-remote-refs=None, the tool emits only a deprecation warning and fetches the URL anyway, following redirects with no IP/host validation, then reflects the response's schema fields into the generated .py file. A public proof-of-concept exists, so no exploit development is needed.