Vulnerabilities for datamodel-code-generator

First version without a known vulnerability: 0.64.0

Details

• GHSA-wjv6-jcfj-mf9r2026-07-28

  `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

  Fixed in: 0.60.2

• GHSA-8359-h9fx-j6v92026-07-28

  datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

  Fixed in: 0.62.0

• GHSA-386q-5hp3-95m92026-07-28

  `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

  Fixed in: 0.60.2

• GHSA-vx7x-vcc2-c44g2026-07-28

  datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

  Fixed in: 0.63.0

• GHSA-8m8r-38jm-f3552026-07-28

  `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

  Fixed in: 0.60.2

• GHSA-954p-556p-r7522026-07-28

  datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

  Fixed in: 0.61.0

• GHSA-5578-w22f-pfx92026-07-28

  datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

  Fixed in: 0.64.0

• GHSA-j884-q54q-mmx32026-07-28

  `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

  Fixed in: 0.60.1

• GHSA-m34r-v34r-rf9q2026-07-28

  `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

  Fixed in: 0.60.2

• GHSA-r5vv-ff45-prp22026-07-28

  datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

  Fixed in: 0.63.0

• GHSA-rfr2-mq9m-x2qx2026-07-28

  datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

  Fixed in: 0.61.0

• GHSA-442q-2j6p-642g2026-07-28

  datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

  Fixed in: 0.62.0