https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:33:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342424 EUVD-2026-342424 https://cve.radiocsirt.org/vuln/euvd-2026-342424 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54690 <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.</p> <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get_ref_body, and the --allow-remote-refs gate can warn instead of blocking, allowing server-side request forgery through src/datamodel_code_generator/http.py. This issue is fixed in version 0.61.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54690 https://cve.radiocsirt.org/vuln/ghsa-954p-556p-r752 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The `--allow-remote-refs` gate added in 0.56.0 defaults to `None`, which only emits a deprecation warning and then fetches the URL anyway; only explicit `--allow-remote-refs=false` blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated `.py` source. As a result, any JSON-Schema document the developer feeds to `datamodel-codegen` — including documents authored by an attacker — can pivot to arbitrary internal addresses and leak the response into the generated code, with no developer cooperation beyond running the tool.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_ref_body` (lines 4776–4793, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_ref_body(self, resolved_ref: str) -&gt; dict[str, YamlValue]: if is_url(resolved_ref): if not resolved_ref.startswith(&#34;file://&#34;) and self.http_local_ref_path is None: if self.allow_remote_refs is False: raise Error(f&#34;Fetching remote $ref is disabled: {resolved_ref}...&#34;) if self.allow_remote_refs is None: warn_deprecated( # (A) warn only &#34;behavior.remote-ref-default&#34;, details=f&#34;Reference: {resolved_ref}&#34;,…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The `--allow-remote-refs` gate added in 0.56.0 defaults to `None`, which only emits a deprecation warning and then fetches the URL anyway; only explicit `--allow-remote-refs=false` blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated `.py` source. As a result, any JSON-Schema document the developer feeds to `datamodel-codegen` — including documents authored by an attacker — can pivot to arbitrary internal addresses and leak the response into the generated code, with no developer cooperation beyond running the tool.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_ref_body` (lines 4776–4793, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_ref_body(self, resolved_ref: str) -&gt; dict[str, YamlValue]: if is_url(resolved_ref): if not resolved_ref.startswith(&#34;file://&#34;) and self.http_local_ref_path is None: if self.allow_remote_refs is False: raise Error(f&#34;Fetching remote $ref is disabled: {resolved_ref}...&#34;) if self.allow_remote_refs is None: warn_deprecated( # (A) warn only &#34;behavior.remote-ref-default&#34;, details=f&#34;Reference: {resolved_ref}&#34;,…</p> https://cve.radiocsirt.org/vuln/ghsa-954p-556p-r752 https://cve.radiocsirt.org/vuln/pysec-2026-3560 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The `--allow-remote-refs` gate added in 0.56.0 defaults to `None`, which only emits a deprecation warning and then fetches the URL anyway; only explicit `--allow-remote-refs=false` blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated `.py` source. As a result, any JSON-Schema document the developer feeds to `datamodel-codegen` — including documents authored by an attacker — can pivot to arbitrary internal addresses and leak the response into the generated code, with no developer cooperation beyond running the tool.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_ref_body` (lines 4776–4793, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_ref_body(self, resolved_ref: str) -&gt; dict[str, YamlValue]: if is_url(resolved_ref): if not resolved_ref.startswith(&#34;file://&#34;) and self.http_local_ref_path is None: if self.allow_remote_refs is False: raise Error(f&#34;Fetching remote $ref is disabled: {resolved_ref}...&#34;) if self.allow_remote_refs is None: warn_deprecated( # (A) warn only &#34;behavior.remote-ref-default&#34;, details=f&#34;Reference: {resolved_ref}&#34;,…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The `--allow-remote-refs` gate added in 0.56.0 defaults to `None`, which only emits a deprecation warning and then fetches the URL anyway; only explicit `--allow-remote-refs=false` blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated `.py` source. As a result, any JSON-Schema document the developer feeds to `datamodel-codegen` — including documents authored by an attacker — can pivot to arbitrary internal addresses and leak the response into the generated code, with no developer cooperation beyond running the tool.</p> <p>### Details</p> <p>Sink: `src/datamodel_code_generator/parser/jsonschema.py`, `_get_ref_body` (lines 4776–4793, at tag `0.60.1` / commit `a321547e`):</p> <p>```python def _get_ref_body(self, resolved_ref: str) -&gt; dict[str, YamlValue]: if is_url(resolved_ref): if not resolved_ref.startswith(&#34;file://&#34;) and self.http_local_ref_path is None: if self.allow_remote_refs is False: raise Error(f&#34;Fetching remote $ref is disabled: {resolved_ref}...&#34;) if self.allow_remote_refs is None: warn_deprecated( # (A) warn only &#34;behavior.remote-ref-default&#34;, details=f&#34;Reference: {resolved_ref}&#34;,…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3560