EUVD-2026-50074
GHSA-954p-556p-r752
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
AnalysisAI
We need to construct a JSON object that synthesizes data from multiple sources about CVE-2026-54690. The input includes description, CVSS, CWE, patch info, CPE, references, tags, etc. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datamodel Code Generator
View allCode injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitr
We need to produce a JSON object with the specified fields. We'll synthesize data from the input. CVE ID: CVE-2026-5538
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the defa
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value t
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL sc
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, referenc
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today