CVE-2026-55391

datamodel-code-generator versions before 0.63.0 validate a fetched URL's host only once (through _validate_url_for_fetch and _get_ips_from_host in http.py) but then let httpx resolve the same host again for the actual connection, a time-of-check-to-time-of-use gap that enables DNS rebinding (CWE-350/CWE-367). An attacker who controls the DNS of a schema URL the tool is asked to fetch can return a public IP for the first lookup, passing the allow_private_network=False SSRF guard, and an internal IP for the second, causing the tool to connect to internal services on the user's network. The result is a server-side request forgery (CWE-918) that chiefly leaks data from internal services (CVSS rates high confidentiality and low integrity impact, with no availability impact), though the rebinding timing makes exploitation difficult (high attack complexity). Anyone running an affected version who uses the tool's URL-fetching mode against a domain whose DNS an attacker can influence is at risk; generating models from local files does not expose this flaw. No in-the-wild exploitation is currently known; a public advisory/PoC exists (GHSA-vx7x-vcc2-c44g), EPSS is 0.2% over 30 days, and the issue is not in CISA KEV.

What to do: Upgrade to datamodel-code-generator 0.63.0 or later, which fixes the double DNS resolution. As an interim measure, avoid fetching schemas with --url from domains whose DNS you do not control (prefer local files or pinned hosts) and review whether codegen or CI jobs have made unexpected connections to internal endpoints after fetching remote schemas.