https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:15:53 +0000 https://db.gcve.eu/vuln/cve-2026-54691 <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.</p> <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.</p> https://db.gcve.eu/vuln/cve-2026-54691 https://db.gcve.eu/vuln/pysec-2026-3564 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>`datamodel-code-generator`&#39;s built-in HTTP fetcher (`http.get_body`) issues an `httpx.GET` against any URL passed to `--url` (or reached via a redirect chain) with **no allow-list, no deny-list, no IP/host validation, and `follow_redirects=True`**. Loopback addresses, RFC1918 ranges, link-local (`169.254.169.254` cloud metadata), unique-local IPv6 and any other network-accessible target are all reachable. The JSON/YAML response body is parsed as a schema and reflected into the generated `.py` source, exfiltrating the response to anyone with access to that file (commonly committed to a repository).</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/http.py`, `get_body` (lines 31–61, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def get_body(url, headers=None, ignore_tls=False, query_parameters=None, timeout=DEFAULT_HTTP_TIMEOUT) -&gt; str: httpx = _get_httpx() try: response = httpx.get( url, headers=headers, verify=not ignore_tls, follow_redirects=True, # (A) params=query_parameters, timeout=timeout, ) except Exception as e: ... if response.status_code &gt;= 400: ... content_type = response.headers.get(&#34;content-type&#34;, &#34;&#34;).lower() if &#34;text/html&#34; in content_type: raise SchemaFetchError(...) # (B) — only filter return response.text # (C) → embedded in generated.py ```</p> <p>- (A) follows r…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>`datamodel-code-generator`&#39;s built-in HTTP fetcher (`http.get_body`) issues an `httpx.GET` against any URL passed to `--url` (or reached via a redirect chain) with **no allow-list, no deny-list, no IP/host validation, and `follow_redirects=True`**. Loopback addresses, RFC1918 ranges, link-local (`169.254.169.254` cloud metadata), unique-local IPv6 and any other network-accessible target are all reachable. The JSON/YAML response body is parsed as a schema and reflected into the generated `.py` source, exfiltrating the response to anyone with access to that file (commonly committed to a repository).</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/http.py`, `get_body` (lines 31–61, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def get_body(url, headers=None, ignore_tls=False, query_parameters=None, timeout=DEFAULT_HTTP_TIMEOUT) -&gt; str: httpx = _get_httpx() try: response = httpx.get( url, headers=headers, verify=not ignore_tls, follow_redirects=True, # (A) params=query_parameters, timeout=timeout, ) except Exception as e: ... if response.status_code &gt;= 400: ... content_type = response.headers.get(&#34;content-type&#34;, &#34;&#34;).lower() if &#34;text/html&#34; in content_type: raise SchemaFetchError(...) # (B) — only filter return response.text # (C) → embedded in generated.py ```</p> <p>- (A) follows r…</p> https://db.gcve.eu/vuln/pysec-2026-3564