SSRF in datamodel-code-generator Exposes Internal Resources via Remote `$ref`

A high-severity server-side request forgery flaw tracked as CVE-2026-54690 affects datamodel-code-generator when it processes attacker-controlled JSON Schema $ref values pointing to http or https URLs. In vulnerable releases, the tool silently resolves remote references during schema processing, allowing outbound requests to arbitrary destinations; one report places the affected range at 0.9.1 through 0.60.x, while another indicates exposure through 0.61.0. The issue has a CVSS v3.1 score of 8.2 and is tied to schema resolution and HTTP fetch logic in files including jsonschema.py and http.py.

Researchers said the vulnerable code passes untrusted URLs directly to the HTTP client, follows redirects, and does not adequately restrict hostnames, ports, or IP ranges, creating a path to reach internal services such as 127.0.0.1 and cloud metadata endpoints like 169.254.169.254. Fetched content may also be incorporated into generated output, raising information disclosure risk in addition to SSRF. The issue is fixed in version 0.61.0, with the patch adding URL validation and blocking localhost-style and non-global IP targets unless private-network access is explicitly enabled; recommended mitigations include disabling remote reference resolution or blocking private-network access.