aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55403 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55403 Source advisory: GHSA-R5VV-FF45-PRP2...

Exposure of Private Personal Information to an Unauthorized Actor

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the getbody function. An attacker can obtain sensitive authorization headers by causing a redirect to a differe...

CVE-2026-55403

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55403 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55403 Source advisory: MEND:CVE-2026-55403...

CVE-2026-55403

CVE-2026-55403 affects the Python package datamodel-code-generator. In versions prior to 0.63.0, the code path in src/datamodel_code_generator/http.py:get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects to fetch remote schemas. This can lea...

CVE-2026-55403 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

CVE-2026-55403 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54691 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54691 Source advisory: GHSA-RFR2-MQ9M-X2QX...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54691 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54691 Source advisory: SNYK:PYTHON-DATAMODELCODEGENERATOR-18388104...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54691 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54691 Source advisory: OSV:GHSA-RFR2-MQ9M-X2QX...

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...

GHSA-RFR2-MQ9M-X2QX datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54691 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54691 Source advisory: MEND:CVE-2026-54691...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

EUVD-2026-50069

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...