CVE-2026-54691

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:29+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rfr2-mq9m-x2qx 2026-07-28 22:48:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqilt74cs24...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...