Loading vulnerability…
SSRF in datamodel-code-generator JSON Schema remote reference handling
CVE-2026-54690 is a server-side request forgery vulnerability in datamodel-code-generator affecting versions 0.9.1 through before 0.61.0. The flaw arises when the tool processes attacker-controlled JSON Schema or OpenAPI input containing HTTP or HTTPS $ref values and silently dereferences those remote references during schema parsing. The vulnerable behavior occurs in the JSON Schema parsing path through the _get_ref_body function and the shared HTTP fetching logic. The --allow-remote-refs control can warn instead of enforcing a block, which allows outbound requests to proceed in scenarios where remote references should not be permitted. As a result, processing untrusted schema content can cause the application to initiate attacker-influenced network requests and incorporate fetched content into generated Python model source.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker who can influence a schema or OpenAPI document processed by datamodel-code-generator to induce outbound HTTP(S) requests from the host running the tool. This can expose internal-only services and sensitive resources reachable from that environment, including cloud metadata and other non-public endpoints. Fetched response content may also be reflected into generated Python source, creating a secondary risk of sensitive data disclosure and contamination of generated artifacts. The available information indicates confidentiality impact is high, integrity impact is limited, and availability impact is not a primary consequence.
If you can’t patch tonight, do this now.
Do not process untrusted or externally supplied schemas or OpenAPI documents with vulnerable versions, especially in environments where the HTTP fetching capability is available. Disable remote reference fetching by setting --allow-remote-refs=false where possible. Restrict outbound network access from code-generation environments so they cannot reach sensitive internal services, metadata endpoints, or other non-public resources. If remote references are required for legitimate workflows, allow them only for trusted inputs and tightly constrain egress to approved destinations.
Patch, then assume compromise.
Upgrade datamodel-code-generator to version 0.61.0 or later. The fixed release hardens remote reference fetching by blocking localhost, loopback, private, link-local, reserved, and other non-public targets by default, validating redirect destinations, and requiring explicit opt-in for trusted private-network access.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.