CVE-2026-54690

datamodel-code-generator versions 0.9.1 until 0.61.0 contain a server-side request forgery flaw (CWE-918): when generating Pydantic v2 models, dataclasses, TypedDict, or msgspec.Struct from JSON Schema or OpenAPI inputs, the tool silently dereferences $ref entries pointing to attacker-controlled HTTP or HTTPS URLs via _get_ref_body in src/datamodel_code_generator/parser/jsonschema.py. An attacker who supplies a crafted schema — for example a third-party API specification or JSON Schema document processed by a developer or a CI/CD pipeline — can make the tool issue arbitrary HTTP(S) requests from the machine running it through src/datamodel_code_generator/http.py, and the --allow-remote-refs gate can merely warn instead of blocking the fetch. A successful attacker can reach internal network resources and cloud instance-metadata endpoints (high confidentiality impact) and, because fetched $ref bodies become part of the generated schema, can inject attacker-influenced content into the generated code (low integrity impact). Anyone running an affected version against untrusted schemas — developer workstations, CI runners, and automated spec-ingestion pipelines — is affected; the tool is a code-generation utility, not an internet-facing service. No in-the-wild exploitation is known, with a low EPSS (0.3%) and one public advisory reference with proof-of-concept detail (GHSA-954p-556p-r752).

What to do: Upgrade datamodel-code-generator to version 0.61.0 or later. Until then, avoid running affected versions against untrusted or third-party JSON Schema/OpenAPI documents, or confine runs to environments with restricted outbound network access, and do not rely on --allow-remote-refs warnings alone since they may warn rather than block. Review developer and CI/CD logs for unexpected outbound HTTP requests to internal or metadata endpoints originating from model-generation jobs.