CVE-2026-54691CWE-918ssrf

CVE-2026-54691

High · published July 29, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-29T02:17Z
References (4)
https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb · [email protected]https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0 · [email protected]https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx · [email protected]https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 JUL 21:29Z
    datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
    cvelistv5