CVE-2026-54690 Details
Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
A vulnerability in datamodel-code-generator versions 0.9.1 through 0.60.2 allows for server-side request forgery (SSRF) by silently dereferencing JSON-Schema $ref values that point to HTTP or HTTPS URLs. This occurs in the 'parser/jsonschema.py' file, specifically within the '_get_ref_body' function. The issue arises because the tool does not validate the IP or host of the URL, lacks a scheme allow-list, and follows redirects unconditionally. As a result, an attacker can exploit this behavior to access internal services and leak their responses through the generated code. The vulnerability is particularly concerning for users who have installed the '[http]' extra, as it amplifies the risk by allowing fetching from remote schemas that could be controlled by an attacker.
Users can update to datamodel-code-generator version 0.61.0 or later, where this vulnerability has been fixed. The latest version can be installed from the Python Package Index (PyPI).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi datamodel-code-generator | >= 0.9.1, < 0.61.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |