CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Summary When generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...

EUVD-2026-50068

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390

The CVE affects datamodel-code-generator where XML Schema parsing (src/datamodel_code_generator/parser/xmlschema.py) for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be...

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

CVE-2026-54654

CVE-2026-54654 affects datamodel-code-generator (versions 0.14.1–0.60.2). The --extra-template-data comment field is rendered into Python comments in multiple templates without neutralizing carriage returns, allowing attacker-controlled comments to inject Python code into generated models that ex...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

PT-2026-65611

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1 Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators function in src/datamodel co...

PT-2026-65609

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.17.0 through 0.60.1 Description Code injection is possible when generating Python models from attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schemas. The issue occurs because th...

PT-2026-65606

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1 Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return r. The software renders this comment variable into Python commen...

PT-2026-65613

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description The get body function in src/datamodel code generator/http.py fails to validate host or IP addresses when processing targets provided via the --url argument or through redirect...

PT-2026-65616

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description When fetching remote schemas, the software re-sends original request headers to redirect targets even if the redirect changes the origin host, port, or scheme. This occurs within th...

PT-2026-65617

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.11.6 through 0.63.0 Description A flaw in the handling of schema extensions allows for remote code execution on the machine that imports the generated model. When processing a malicious OpenAPI or JSON Schem...

PT-2026-65610

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1 Description Insufficient validation of x-python-type values in the get python type override function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JS...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...