https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:06:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-55403 <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.</p> <p><strong>Affected:</strong> koxudaxi datamodel-code-generator</p> <p>datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-55403 https://cve.radiocsirt.org/vuln/ghsa-r5vv-ff45-prp2 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any `Authorization` header, to the redirect target even when the redirect changes origin (host/port/scheme). Credentials that an operator scoped to a trusted schema host are therefore forwarded to an attacker-controlled or otherwise different host, leaking them.</p> <p>### Details</p> <p>In `src/datamodel_code_generator/http.py`, `get_body()` follows redirects manually and re-issues each hop with the same `headers` argument, with no check that the origin is unchanged:</p> <p>```python for redirect_count in range(MAX_HTTP_REDIRECTS + 1): _validate_url_for_fetch(current_url, allow_private_network=allow_private_network) response = httpx.get(current_url, headers=headers, follow_redirects=False, ...) # same headers every hop if (redirect_url := _get_redirect_url(httpx, current_url, response)) is None: break current_url = redirect_url ```</p> <p>Browsers and HTTP clients such as `requests`/`httpx` strip `Authorization` when a redirect crosses origin; here it is preserved unconditionally. Headers are operator-supplied via `--http-headers` (and credentials can also arrive through `--url` userinfo), so a redirect from the trusted host to any other host discloses them.</p> <p>### PoC</p> <p>Self-contained reproducer: https://gist.github.com/thegr1ffyn/ade3035d7f2be95e16f11698259cdbc2 Host A (the trusted schema host) 302-redirects to host B (a di…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>### Summary</p> <p>When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any `Authorization` header, to the redirect target even when the redirect changes origin (host/port/scheme). Credentials that an operator scoped to a trusted schema host are therefore forwarded to an attacker-controlled or otherwise different host, leaking them.</p> <p>### Details</p> <p>In `src/datamodel_code_generator/http.py`, `get_body()` follows redirects manually and re-issues each hop with the same `headers` argument, with no check that the origin is unchanged:</p> <p>```python for redirect_count in range(MAX_HTTP_REDIRECTS + 1): _validate_url_for_fetch(current_url, allow_private_network=allow_private_network) response = httpx.get(current_url, headers=headers, follow_redirects=False, ...) # same headers every hop if (redirect_url := _get_redirect_url(httpx, current_url, response)) is None: break current_url = redirect_url ```</p> <p>Browsers and HTTP clients such as `requests`/`httpx` strip `Authorization` when a redirect crosses origin; here it is preserved unconditionally. Headers are operator-supplied via `--http-headers` (and credentials can also arrive through `--url` userinfo), so a redirect from the trusted host to any other host discloses them.</p> <p>### PoC</p> <p>Self-contained reproducer: https://gist.github.com/thegr1ffyn/ade3035d7f2be95e16f11698259cdbc2 Host A (the trusted schema host) 302-redirects to host B (a di…</p> https://cve.radiocsirt.org/vuln/ghsa-r5vv-ff45-prp2