Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-54653
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
Publish Date: 2026-07-28
URL: CVE-2026-54653
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.2
Step up your Open Source Security Game with Mend here
CVE-2026-54691
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.
Publish Date: 2026-07-28
URL: CVE-2026-54691
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.61.0
Step up your Open Source Security Game with Mend here
CVE-2026-54690
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
Publish Date: 2026-07-28
URL: CVE-2026-54690
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.61.0
Step up your Open Source Security Game with Mend here
CVE-2026-54654
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.
Publish Date: 2026-07-28
URL: CVE-2026-54654
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.2
Step up your Open Source Security Game with Mend here
CVE-2026-54621
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.
Publish Date: 2026-07-28
URL: CVE-2026-54621
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.1
Step up your Open Source Security Game with Mend here
CVE-2026-63720
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Publish Date: 2026-07-26
URL: CVE-2026-63720
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-26
Fix Resolution: 0.70.0
Step up your Open Source Security Game with Mend here
CVE-2026-55415
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Publish Date: 2026-07-28
URL: CVE-2026-55415
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.64.0
Step up your Open Source Security Game with Mend here
CVE-2026-55391
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Publish Date: 2026-07-28
URL: CVE-2026-55391
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.63.0
Step up your Open Source Security Game with Mend here
CVE-2026-55389
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.
Publish Date: 2026-07-28
URL: CVE-2026-55389
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.62.0
Step up your Open Source Security Game with Mend here
CVE-2026-55403
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
- ❌ datamodel_code_generator-0.25.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Publish Date: 2026-07-28
URL: CVE-2026-55403
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.63.0
Step up your Open Source Security Game with Mend here
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
Publish Date: 2026-07-28
URL: CVE-2026-54653
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.
Publish Date: 2026-07-28
URL: CVE-2026-54691
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.61.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.
Publish Date: 2026-07-28
URL: CVE-2026-54690
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.61.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 without neutralizing carriage returns in Python # comments, allowing an attacker-controlled comment value to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.2.
Publish Date: 2026-07-28
URL: CVE-2026-54654
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-controlled GraphQL schema content to inject Python code into generated models that runs when imported. This issue is fixed in version 0.60.1.
Publish Date: 2026-07-28
URL: CVE-2026-54621
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.60.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.
Publish Date: 2026-07-26
URL: CVE-2026-63720
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-26
Fix Resolution: 0.70.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
Publish Date: 2026-07-28
URL: CVE-2026-55415
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.64.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Publish Date: 2026-07-28
URL: CVE-2026-55391
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.63.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.
Publish Date: 2026-07-28
URL: CVE-2026-55389
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.62.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - datamodel_code_generator-0.25.3-py3-none-any.whl
Datamodel Code Generator
Library home page: https://files.pythonhosted.org/packages/84/22/d392e1a2ffd067a26eabbc66c1f3dc22805323001e747ee0873fcf6b5802/datamodel_code_generator-0.25.3-py3-none-any.whl
Sample Path to Dependency File: /api/requirements.txt
Path to vulnerable library: /api/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 1fc76088d115ca2a2f6ae32d49d53ed791dd82df
Found in base branch: develop
Vulnerability Details
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Publish Date: 2026-07-28
URL: CVE-2026-55403
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-28
Fix Resolution: https://github.com/koxudaxi/datamodel-code-generator.git - 0.63.0
Step up your Open Source Security Game with Mend here