EUVD-2026-50074
GHSA-954p-556p-r752
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Unauthenticated attacker supplies a schema but a developer must run the tool (UI:R); SSRF pivots to internal systems (S:C); only reflected schema fields leak (C:L) and generated code is tainted (I:L), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
AnalysisAI
Server-side request forgery in datamodel-code-generator 0.9.1 through 0.60.x lets a malicious JSON Schema, OpenAPI, or GraphQL document cause the code generator to silently fetch attacker-chosen HTTP/HTTPS $ref URLs - including internal, loopback, and link-local addresses - and reflect the fetched content into the generated Python source. Exploitation requires the optional HTTP extra (pip install 'datamodel-code-generator[http]') and a developer or automated codegen/CI job to run datamodel-codegen against the tainted document; the default configuration (--allow-remote-refs unset) only emits a deprecation warning before fetching, and only an explicit --allow-remote-refs=false blocks the request. Publicly available exploit code exists (a Gist proof-of-concept), and EPSS is low at 0.21% (11th percentile), with no confirmed active exploitation (not in CISA KEV); fixed in 0.61.0.
Technical ContextAI
The flaw is a classic SSRF (CWE-918) rooted in the JSON Schema $ref resolution logic of src/datamodel_code_generator/parser/jsonschema.py. In the affected range, _get_ref_body() checks is_url(resolved_ref) and, when allow_remote_refs is False, raises an error - but when allow_remote_refs is None (the default added in 0.56.0), it merely calls warn_deprecated() and falls through to _get_ref_body_from_url(), which routes the URL through _get_text_from_url()/get_body() in src/datamodel_code_generator/http.py. That fetcher performs no IP or host validation, applies no scheme allow-list, and follows HTTP redirects unconditionally, so a $ref such as "$ref": "http://169.254.169.254/latest/meta-data/" or an internal service URL will be dereferenced. The retrieved body is then parsed as a sub-schema and merged into the model graph, so attacker-influenced fields (title, description, properties) are rendered verbatim into the emitted .py file - turning the SSRF into a data-exfiltration path into generated code. The fix commit 5fdba4a adds a new --allow-private-network flag (default False) to docs, __init__.py, __main__.py, and _types, blocking private/loopback/link-local targets unless explicitly allowed, and tightens the interaction between --url and --allow-remote-refs. Only installations with the [http] extra are reachable, since without it there is no network fetcher.
RemediationAI
Upgrade to datamodel-code-generator 0.61.0 or later (pip install --upgrade 'datamodel-code-generator[http]'); this is the vendor-released patch containing commit 5fdba4a, which adds the --allow-private-network gate defaulting to False and blocks non-public network targets. If immediate upgrade is not possible, the most effective compensating control is to invoke the tool with an explicit --allow-remote-refs=false, which raises an Error instead of warning and fetching - note this will break legitimate workflows that intentionally resolve remote $refs, so any needed remote schemas should be vendored locally first. Because the vulnerable behavior only triggers with the network-capable extra, uninstalling it (reinstalling the package without [http]) removes the fetcher entirely at the cost of losing remote-URL support. Running codegen only on schemas of trusted provenance, and executing datamodel-codegen inside a sandbox or CI container with egress restricted to the public internet (blocking RFC1918, 127.0.0.0/8, 169.254.0.0/16, and cloud metadata endpoints) limits both the SSRF reach and the leakage of responses into generated source; this is a defense-in-depth measure and not a substitute for patching. References: https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-954p-556p-r752, https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0, and https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb.
More in Datamodel Code Generator
View allCode injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitr
Arbitrary local file read in datamodel-code-generator before 0.62.0 lets unauthenticated attackers who control or can su
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the defa
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value t
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL sc
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, referenc
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today