CVE-2026-54621

datamodel-code-generator from 0.59.0 until 0.81.0 has a vulnerability where an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports. Exploitation requires a victim or automated job to process the schema with Protobuf input support (grpcio-tools). The paths escape the weak_imports temporary directory, allowing creation of directory trees, new files, or overwrite of existing writable files with a generated Protobuf syntax declaration.

In datamodel-code-generator from 0.11.6 to 0.64.0, attacker-controlled x-python-import or customTypePath schema extensions can reach the JSON Schema parser and generate imports that allow newline injection into import statements, executing Python code when the generated model is imported.

In datamodel-code-generator prior to version 0.63.0, the get_body function reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, potentially leaking credentials to external servers. This issue has been fixed in version 0.63.0.

In datamodel-code-generator before version 0.63.0, URL host validation checks the host once but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_private_network=False and reach internal services.

In datamodel-code-generator from 0.59.0 to 0.62.0, XML Schema parsing resolves schemaLocation values in xs:include, xs:import, xs:redefine, and xs:override outside the input base path, allowing arbitrary local files to be read and reflected into generated models.

The datamodel-code-generator tool before version 0.62.0 improperly handles JSON Schema $ref references, allowing arbitrary local file reads. The vulnerability is in jsonschema.py, which does not block file:// or ../ paths outside the input directory.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 does not validate hosts/IPs in URL targets and redirects, enabling SSRF attacks against internal resources. The vulnerability is in the http.get_body function.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 automatically dereferences JSON Schema $ref references from HTTP/HTTPS without proper blocking, enabling SSRF attacks. The --allow-remote-refs flag only warns instead of blocking.

The datamodel-code-generator tool from version 0.52.1 to 0.60.2 interpolates validators from --extra-template-data without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported.

The datamodel-code-generator tool from version 0.51.0 to 0.60.2 inserts x-python-type values into field annotations without sufficient validation, allowing Python code execution when the generated module is imported.