AIKIDO-2026-789112
datamodel-code-generator is vulnerable to Server-Side Request Forgery (SSRF)
82
High Risk
This Affects:
datamodel-code-generatorTL;DR
Remote JSON Schema and OpenAPI $ref values pointing at HTTP(S) URLs are fetched through the shared HTTP helper when remote references are allowed. With the [http] extra installed, a schema document supplied by an attacker can trigger fetches to internal services and embed the response into generated code without the developer typing a URL. Before the fix, the default allow_remote_refs behavior still fetched remote refs after only a deprecation warning. The fix applies the shared URL and redirect validation so non-public targets are blocked unless private network access is explicitly enabled.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and have installed the [http] extra.
Background info
datamodel-code-generator is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.9.1 - 0.60.2.
How to fix this
Upgrade the datamodel-code-generator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant