EUVD-2026-50076
GHSA-vx7x-vcc2-c44g
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication DNS-independent verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default allow_private_network=False restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Datamodel Code Generator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Datamodel Code Generator
View allServer-side request forgery in datamodel-code-generator 0.9.1 through 0.60.x lets a malicious JSON Schema, OpenAPI, or G
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitr
Processing an attacker-controlled Protobuf schema with datamodel-code-generator 0.59.0 through 0.80.0 lets a crafted wea
Arbitrary local file read in datamodel-code-generator before 0.62.0 lets unauthenticated attackers who control or can su
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value t
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL sc
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, referenc
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to
Exploit-DB