EUVD-2026-50076
GHSA-vx7x-vcc2-c44g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
AnalysisAI
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default allow_private_network=False restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datamodel Code Generator
View allWe need to construct a JSON object that synthesizes data from multiple sources about CVE-2026-54690. The input includes
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitr
We need to produce a JSON object with the specified fields. We'll synthesize data from the input. CVE ID: CVE-2026-5538
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value t
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL sc
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, referenc
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today