CVE-2026-54691 Details
Description
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.
A server-side request forgery (SSRF) vulnerability has been identified in datamodel-code-generator versions 0.9.1 through 0.60.2. The issue arises because the tool's HTTP fetcher does not validate hosts or IPs for URLs provided via the --url option or those reached through redirects. This lack of validation allows fetching from loopback, private, link-local, metadata, and other network-accessible resources. The vulnerability is particularly concerning as it can exfiltrate sensitive information, such as cloud metadata or responses from internal services, into generated Python files. This issue has been patched in version 0.61.0.
Users can update to datamodel-code-generator version 0.61.0 or later, where this vulnerability has been fixed. The patched version blocks private network requests by default and requires explicit permission to fetch from internal endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb | [email protected] | Source CodeVendor |
| https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0 | [email protected] | Release NotesVendor |
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi datamodel-code-generator | >= 0.9.1, <= 0.60.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |